Re: [gentoo-user] Syslog-ng "Failed to seek to the Cursor"

[Alan McKinnon]

On 16/09/2015 21:42, Rich Freeman wrote:
> On Wed, Sep 16, 2015 at 12:55 PM, Alan McKinnon <alan.mckinnon@×××××.com> wrote:
>>
>> It has something to do with systemd's log thingy.
>>
>> The error only appears in one place in the syslog-ng source,
>> in modules/systemd-journal/journal-reader.c:
>>
>> static inline gboolean
>> __seek_to_saved_state(JournalReader *self)
>> {
>>   JournalReaderState *state =
>> persist_state_map_entry(self->persist_state, self->persist_handle);
>>   gint rc = journald_seek_cursor(self->journal, state->cursor);
>>   persist_state_unmap_entry(self->persist_state, self->persist_handle);
>>   if (rc != 0)
>>     {
>>       msg_warning("Failed to seek to the cursor",
>>           evt_tag_str("cursor", state->cursor),
>>           evt_tag_errno("error", errno),
>>           NULL);
>>       return __seek_to_head(self);
>>     }
>>   journald_next(self->journal);
>>   return TRUE;
>> }
>>
>
> The other posts are getting at the solution - disable journal support
> if you're not actually using systemd.
>
> However, does syslog-ng actually READ logs?  My understanding is that
> journal cursors are used to read logs, not to write them, and I
> associate syslog-ng more with writing logs.
>
> The concept is that when you query the journal every record gets
> returned with a cursor, which is just a guid of some sort.  Then you
> can run a later query and pass the last cursor you saw back and just
> get a list of new records since the last one you read.  The use case
> is for log monitors and such so that they can periodically poll the
> log without having to read the entire thing from the beginning each
> time.
>


Digging up ancient memory from other people's posts long ago:

Doesn't syslog-ng read systemd's log from early userspace startup
(before syslog-ng starts) and write those entries to syslog-ng?

-- 
Alan McKinnon
alan.mckinnon@×××××.com