On Thu, 28 Jan 2016, Michael Biebl wrote:
2016-01-27 23:37 GMT+01:00 Peter Portante <peter.a.porta...@gmail.com>:
As I can't look into the future, I'm just talking about the status-quo
in Debian:
We do install rsyslog by default in our current stable release
(Jessie, aka 8.0) and that's still the case for testing/unstable.
journald is setup to forward messages to rsyslog (aka. push model)
We use imjournal in fedora, rhel, centos, with systemd listening for logs
on /dev/log and then rsyslog pulling them.
imjournal only works halfway decently if you have a persistent
journal. As I mentioned, we don't use persistent journal in Debian
(for one, to avoid writing log messages to disk twice).
imjournal did also have quite some serious bugs in the past (like
getting stuck in a loop generating a flood of log messages filling up
the disk). So I'm not yet comfortable enabling that. Especially since
there is no official *upstream* support for imjournal.
technically that was a bug in systemd, it's 'next message' pointers formed a
loop.
I also wonder, what the performance overhead is for imjournal. I
suspect that the throughput using
ForwardToSyslog=yes is higher. If anyone has benchmarks for that, I'd
appreciate that.
when forwarding to syslog you have a few different things.
If you have systemd forge the metadata, it's expensive
But forwarding the message should be relativly cheap, cheaper than polling for
messages.
This is why I would like to have the JSON output from systemd to *syslog, that
way all the metadata can be sent without all the syscall work needed to forge
and fetch it (along with the added metadata that journald creates, which would
be utterly lost otherwise. Rsyslog could create the same etadata if the apps
talked directly to it, but it only sees one hop.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
