1 |
On Wed, Sep 16, 2015 at 12:55 PM, Alan McKinnon <alan.mckinnon@×××××.com> wrote: |
2 |
> |
3 |
> It has something to do with systemd's log thingy. |
4 |
> |
5 |
> The error only appears in one place in the syslog-ng source, |
6 |
> in modules/systemd-journal/journal-reader.c: |
7 |
> |
8 |
> static inline gboolean |
9 |
> __seek_to_saved_state(JournalReader *self) |
10 |
> { |
11 |
> JournalReaderState *state = |
12 |
> persist_state_map_entry(self->persist_state, self->persist_handle); |
13 |
> gint rc = journald_seek_cursor(self->journal, state->cursor); |
14 |
> persist_state_unmap_entry(self->persist_state, self->persist_handle); |
15 |
> if (rc != 0) |
16 |
> { |
17 |
> msg_warning("Failed to seek to the cursor", |
18 |
> evt_tag_str("cursor", state->cursor), |
19 |
> evt_tag_errno("error", errno), |
20 |
> NULL); |
21 |
> return __seek_to_head(self); |
22 |
> } |
23 |
> journald_next(self->journal); |
24 |
> return TRUE; |
25 |
> } |
26 |
> |
27 |
|
28 |
The other posts are getting at the solution - disable journal support |
29 |
if you're not actually using systemd. |
30 |
|
31 |
However, does syslog-ng actually READ logs? My understanding is that |
32 |
journal cursors are used to read logs, not to write them, and I |
33 |
associate syslog-ng more with writing logs. |
34 |
|
35 |
The concept is that when you query the journal every record gets |
36 |
returned with a cursor, which is just a guid of some sort. Then you |
37 |
can run a later query and pass the last cursor you saw back and just |
38 |
get a list of new records since the last one you read. The use case |
39 |
is for log monitors and such so that they can periodically poll the |
40 |
log without having to read the entire thing from the beginning each |
41 |
time. |
42 |
|
43 |
-- |
44 |
Rich |