[gentoo-amd64] Re: Systemd migration: opinion and questions

[Duncan]

Rich Freeman posted on Wed, 25 Feb 2015 07:13:03 -0500 as excerpted:

> On Wed, Feb 25, 2015 at 5:13 AM, Duncan <1i5t5.duncan@×××.net> wrote:
>>
>> a) If the system crashes, partially corrupted in-the-crash text logs
>> can be of at least some use after a reboot.  Binary journals, not so
>> much.
>
> Have you tested this, or found some other data to support this?  I think
> that journalctl does parse truncated files.

I believe I've seen posts to that effect on the btrfs list (my biggest 
non-gentoo participation).  Note that journald does rotation of I believe 
8 journal files by default, and ideally, it'd only be the last one chewed 
up.  Also, cleanly truncated is one thing; file-system-corrupted so it 
ends up with a piece of some other totally different file in it (as most 
more modern filesystems take pains to prevent, at least on Linux, as the 
other file might be from another user and that ends up being a security 
risk, so modern filesystems generally zero-truncate it if they think it 
might be corrupted in that manner) is something entirely different.

However, fair point.  My support on this bit /is/ a bit fuzzier than I'd 
like.  Thanks for pointing that out, to me as well.  =:^)

>> But syslog-ng lets me dump them without ever actually logging them, or
>> route them to a different log file if I prefer, keeping my primary logs
>> clean. =:^)
>
> I was thinking about this and another advantage of split log files is
> that you could have different rotation/retention policies for each.  I
> believe journald's log rotation is one-size-fits-all.

I believe so... because everything journald logs (well, everything 
system, user session logs are I'm pretty sure treated separately, at 
least with persistent storage enabled, there's a note somewhere in the 
documentation that if volatile-only is set, journald throws user journals 
in with the system journals too, which implies it doesn't, with 
persistent storage) is thrown in the same log, so there's little choice 
on rotation strategy.

But of course syslog-ng allows you to split the logs however you want, 
and route individual log messages to one or more logs.  And those logs in 
turn can be rotated on entirely different policies.

Thanks for that point too.  I'm so used to thinking in terms of being 
able to split logs and setup individual logrotate policies for them, I 
hadn't even considered that implication of the common journald journals.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman