Re: [systemd-devel] Backup the current boot logs in raw format
On Thu, Aug 01, 2019 at 10:52:07AM +0200, Francis Moreau wrote: > On Thu, Aug 1, 2019 at 10:36 AM Zbigniew Jędrzejewski-Szmek > wrote: > > > > On Thu, Aug 01, 2019 at 10:26:50AM +0200, Francis Moreau wrote: > > > On Thu, Aug 1, 2019 at 9:45 AM Zbigniew Jędrzejewski-Szmek > > > wrote: > > > > > > > > On Thu, Aug 01, 2019 at 09:11:19AM +0200, Francis Moreau wrote: > > > > > On Wed, Jul 24, 2019 at 4:08 PM Zbigniew Jędrzejewski-Szmek > > > > > wrote: > > > > > > you can export and write to a journal file with: > > > > > > journalctl -o export ... | > > > > > > /usr/lib/systemd/systemd-journal-remote -o /tmp/foo.journal - > > > > > > This has the advantage that you can apply any journalctl filter > > > > > > where > > > > > > the dots are, e.g. '-b'. > > > > > > > > > > This doesn't look to work correctly: > > > > > > > > > > $ journalctl -b | head > > > > > -- Logs begin at Thu 2017-04-13 14:05:51 CEST, end at Thu 2019-08-01 > > > > > 08:51:39 CEST. -- > > > > > Mar 25 06:51:35 crapovo kernel: microcode: microcode updated early to > > > > > revision 0x25, date = 2018-04-02 > > > > > > > > > > $ journalctl -o export -b | /usr/lib/systemd/systemd-journal-remote -o > > > > > /tmp/foo.journal - > > > > > $ journalctl -b --file=/tmp/foo.journal | head > > > > > -- Logs begin at Sat 2019-06-22 18:32:31 CEST, end at Thu 2019-08-01 > > > > > 08:45:45 CEST. -- > > > > > Jun 22 18:32:31 crapovo polkitd[1278]: Unregistered Authentication > > > > > Agent for unix-process:7300:772806437 (system bus name :1.4562, object > > > > > path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale > > > > > en_US.UTF-8) (disconnected from bus) > > > > > > > > > > As you can see, the start is not the same. > > > > > > > > > > Also are foo.journal data compressed ? > > > > > > > > What does "ls /tmp/foo*" say? > > > > > > > > > > /tmp/foo@4e9f5da4aaac4433bc8744fe49e25b5a-0001-000584e4cc1ef61f.journal > > > /tmp/foo.journal > > > > systemd-journal-remote will "rotate" files when they grow above certain > > size. > > (The same as systemd-journald). 'journalctl --file=/tmp/foo*.journal' should > > do the trick. > > Indeed that did the trick, thanks ! > > It's a bit counterintuitive because I asked the journal to be saved in > /tmp/foo.journal only. Can this "rotation" be disabled somehow ? Unfortunately not. That's because of the heritage of those programs which were written in mind with continuous reception of logs in mind, and "conversions" like the one above were just a fortunate side-effect. I guess it'd be nice to make it possible to disable rotation. Zbyszek ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/systemd-devel
Re: [systemd-devel] Backup the current boot logs in raw format
On Thu, Aug 1, 2019 at 10:36 AM Zbigniew Jędrzejewski-Szmek wrote: > > On Thu, Aug 01, 2019 at 10:26:50AM +0200, Francis Moreau wrote: > > On Thu, Aug 1, 2019 at 9:45 AM Zbigniew Jędrzejewski-Szmek > > wrote: > > > > > > On Thu, Aug 01, 2019 at 09:11:19AM +0200, Francis Moreau wrote: > > > > On Wed, Jul 24, 2019 at 4:08 PM Zbigniew Jędrzejewski-Szmek > > > > wrote: > > > > > you can export and write to a journal file with: > > > > > journalctl -o export ... | /usr/lib/systemd/systemd-journal-remote > > > > > -o /tmp/foo.journal - > > > > > This has the advantage that you can apply any journalctl filter where > > > > > the dots are, e.g. '-b'. > > > > > > > > This doesn't look to work correctly: > > > > > > > > $ journalctl -b | head > > > > -- Logs begin at Thu 2017-04-13 14:05:51 CEST, end at Thu 2019-08-01 > > > > 08:51:39 CEST. -- > > > > Mar 25 06:51:35 crapovo kernel: microcode: microcode updated early to > > > > revision 0x25, date = 2018-04-02 > > > > > > > > $ journalctl -o export -b | /usr/lib/systemd/systemd-journal-remote -o > > > > /tmp/foo.journal - > > > > $ journalctl -b --file=/tmp/foo.journal | head > > > > -- Logs begin at Sat 2019-06-22 18:32:31 CEST, end at Thu 2019-08-01 > > > > 08:45:45 CEST. -- > > > > Jun 22 18:32:31 crapovo polkitd[1278]: Unregistered Authentication > > > > Agent for unix-process:7300:772806437 (system bus name :1.4562, object > > > > path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale > > > > en_US.UTF-8) (disconnected from bus) > > > > > > > > As you can see, the start is not the same. > > > > > > > > Also are foo.journal data compressed ? > > > > > > What does "ls /tmp/foo*" say? > > > > > > > /tmp/foo@4e9f5da4aaac4433bc8744fe49e25b5a-0001-000584e4cc1ef61f.journal > > /tmp/foo.journal > > systemd-journal-remote will "rotate" files when they grow above certain size. > (The same as systemd-journald). 'journalctl --file=/tmp/foo*.journal' should > do the trick. Indeed that did the trick, thanks ! It's a bit counterintuitive because I asked the journal to be saved in /tmp/foo.journal only. Can this "rotation" be disabled somehow ? -- Francis ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/systemd-devel
Re: [systemd-devel] Backup the current boot logs in raw format
On Thu, Aug 01, 2019 at 10:26:50AM +0200, Francis Moreau wrote: > On Thu, Aug 1, 2019 at 9:45 AM Zbigniew Jędrzejewski-Szmek > wrote: > > > > On Thu, Aug 01, 2019 at 09:11:19AM +0200, Francis Moreau wrote: > > > On Wed, Jul 24, 2019 at 4:08 PM Zbigniew Jędrzejewski-Szmek > > > wrote: > > > > you can export and write to a journal file with: > > > > journalctl -o export ... | /usr/lib/systemd/systemd-journal-remote -o > > > > /tmp/foo.journal - > > > > This has the advantage that you can apply any journalctl filter where > > > > the dots are, e.g. '-b'. > > > > > > This doesn't look to work correctly: > > > > > > $ journalctl -b | head > > > -- Logs begin at Thu 2017-04-13 14:05:51 CEST, end at Thu 2019-08-01 > > > 08:51:39 CEST. -- > > > Mar 25 06:51:35 crapovo kernel: microcode: microcode updated early to > > > revision 0x25, date = 2018-04-02 > > > > > > $ journalctl -o export -b | /usr/lib/systemd/systemd-journal-remote -o > > > /tmp/foo.journal - > > > $ journalctl -b --file=/tmp/foo.journal | head > > > -- Logs begin at Sat 2019-06-22 18:32:31 CEST, end at Thu 2019-08-01 > > > 08:45:45 CEST. -- > > > Jun 22 18:32:31 crapovo polkitd[1278]: Unregistered Authentication > > > Agent for unix-process:7300:772806437 (system bus name :1.4562, object > > > path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale > > > en_US.UTF-8) (disconnected from bus) > > > > > > As you can see, the start is not the same. > > > > > > Also are foo.journal data compressed ? > > > > What does "ls /tmp/foo*" say? > > > > /tmp/foo@4e9f5da4aaac4433bc8744fe49e25b5a-0001-000584e4cc1ef61f.journal > /tmp/foo.journal systemd-journal-remote will "rotate" files when they grow above certain size. (The same as systemd-journald). 'journalctl --file=/tmp/foo*.journal' should do the trick. Zbyszek ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/systemd-devel
Re: [systemd-devel] Backup the current boot logs in raw format
On Thu, Aug 1, 2019 at 9:45 AM Zbigniew Jędrzejewski-Szmek wrote: > > On Thu, Aug 01, 2019 at 09:11:19AM +0200, Francis Moreau wrote: > > On Wed, Jul 24, 2019 at 4:08 PM Zbigniew Jędrzejewski-Szmek > > wrote: > > > you can export and write to a journal file with: > > > journalctl -o export ... | /usr/lib/systemd/systemd-journal-remote -o > > > /tmp/foo.journal - > > > This has the advantage that you can apply any journalctl filter where > > > the dots are, e.g. '-b'. > > > > This doesn't look to work correctly: > > > > $ journalctl -b | head > > -- Logs begin at Thu 2017-04-13 14:05:51 CEST, end at Thu 2019-08-01 > > 08:51:39 CEST. -- > > Mar 25 06:51:35 crapovo kernel: microcode: microcode updated early to > > revision 0x25, date = 2018-04-02 > > > > $ journalctl -o export -b | /usr/lib/systemd/systemd-journal-remote -o > > /tmp/foo.journal - > > $ journalctl -b --file=/tmp/foo.journal | head > > -- Logs begin at Sat 2019-06-22 18:32:31 CEST, end at Thu 2019-08-01 > > 08:45:45 CEST. -- > > Jun 22 18:32:31 crapovo polkitd[1278]: Unregistered Authentication > > Agent for unix-process:7300:772806437 (system bus name :1.4562, object > > path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale > > en_US.UTF-8) (disconnected from bus) > > > > As you can see, the start is not the same. > > > > Also are foo.journal data compressed ? > > What does "ls /tmp/foo*" say? > /tmp/foo@4e9f5da4aaac4433bc8744fe49e25b5a-0001-000584e4cc1ef61f.journal /tmp/foo.journal -- Francis ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/systemd-devel
Re: [systemd-devel] Backup the current boot logs in raw format
On Thu, Aug 01, 2019 at 09:11:19AM +0200, Francis Moreau wrote: > On Wed, Jul 24, 2019 at 4:08 PM Zbigniew Jędrzejewski-Szmek > wrote: > > you can export and write to a journal file with: > > journalctl -o export ... | /usr/lib/systemd/systemd-journal-remote -o > > /tmp/foo.journal - > > This has the advantage that you can apply any journalctl filter where > > the dots are, e.g. '-b'. > > This doesn't look to work correctly: > > $ journalctl -b | head > -- Logs begin at Thu 2017-04-13 14:05:51 CEST, end at Thu 2019-08-01 > 08:51:39 CEST. -- > Mar 25 06:51:35 crapovo kernel: microcode: microcode updated early to > revision 0x25, date = 2018-04-02 > > $ journalctl -o export -b | /usr/lib/systemd/systemd-journal-remote -o > /tmp/foo.journal - > $ journalctl -b --file=/tmp/foo.journal | head > -- Logs begin at Sat 2019-06-22 18:32:31 CEST, end at Thu 2019-08-01 > 08:45:45 CEST. -- > Jun 22 18:32:31 crapovo polkitd[1278]: Unregistered Authentication > Agent for unix-process:7300:772806437 (system bus name :1.4562, object > path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale > en_US.UTF-8) (disconnected from bus) > > As you can see, the start is not the same. > > Also are foo.journal data compressed ? What does "ls /tmp/foo*" say? Zbyszek ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/systemd-devel
Re: [systemd-devel] Backup the current boot logs in raw format
On Wed, Jul 24, 2019 at 4:08 PM Zbigniew Jędrzejewski-Szmek wrote: > you can export and write to a journal file with: > journalctl -o export ... | /usr/lib/systemd/systemd-journal-remote -o > /tmp/foo.journal - > This has the advantage that you can apply any journalctl filter where > the dots are, e.g. '-b'. This doesn't look to work correctly: $ journalctl -b | head -- Logs begin at Thu 2017-04-13 14:05:51 CEST, end at Thu 2019-08-01 08:51:39 CEST. -- Mar 25 06:51:35 crapovo kernel: microcode: microcode updated early to revision 0x25, date = 2018-04-02 $ journalctl -o export -b | /usr/lib/systemd/systemd-journal-remote -o /tmp/foo.journal - $ journalctl -b --file=/tmp/foo.journal | head -- Logs begin at Sat 2019-06-22 18:32:31 CEST, end at Thu 2019-08-01 08:45:45 CEST. -- Jun 22 18:32:31 crapovo polkitd[1278]: Unregistered Authentication Agent for unix-process:7300:772806437 (system bus name :1.4562, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus) As you can see, the start is not the same. Also are foo.journal data compressed ? Thank you. -- Francis ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/systemd-devel
Re: [systemd-devel] Backup the current boot logs in raw format
On Wed, Jul 24, 2019 at 4:08 PM Zbigniew Jędrzejewski-Szmek wrote: > journalctl -o export ... | /usr/lib/systemd/systemd-journal-remote -o > /tmp/foo.journal - > This has the advantage that you can apply any journalctl filter where > the dots are, e.g. '-b'. Thanks ! It's documented in man page but I wasn't sure that I didn't miss somthing else because it is a bit strange to use an additional tool (systemd-journal-remote) to do that. Something like: journalctl -o raw -b >/tmp/foo.journal -- Francis ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/systemd-devel
Re: [systemd-devel] Backup the current boot logs in raw format
On Wed, Jul 24, 2019 at 03:48:40PM +0200, Francis Moreau wrote: > Hi, > > I would like to backup the journal logs for the current boot in a > "raw" format so I can reuse it later with "journalctl > --file=my-backup". > > But looking at the different values for "-o" option I can't find the answer. > > Could anybody give me some clues ? One option is to simply copy some of the files in /var/log/journal to a different location. You can then read them with 'journalctl -D'. If you want to be more granular and only select specific log entries, you can export and write to a journal file with: journalctl -o export ... | /usr/lib/systemd/systemd-journal-remote -o /tmp/foo.journal - This has the advantage that you can apply any journalctl filter where the dots are, e.g. '-b'. Zbyszek ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/systemd-devel
[systemd-devel] Backup the current boot logs in raw format
Hi, I would like to backup the journal logs for the current boot in a "raw" format so I can reuse it later with "journalctl --file=my-backup". But looking at the different values for "-o" option I can't find the answer. Could anybody give me some clues ? Thanks. -- Francis ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/systemd-devel
