1 |
On Wed, Sep 16, 2015 at 3:57 PM, Alan McKinnon <alan.mckinnon@×××××.com> wrote: |
2 |
> On 16/09/2015 21:42, Rich Freeman wrote: |
3 |
>> On Wed, Sep 16, 2015 at 12:55 PM, Alan McKinnon <alan.mckinnon@×××××.com> wrote: |
4 |
>>> |
5 |
>>> It has something to do with systemd's log thingy. |
6 |
>>> |
7 |
>>> The error only appears in one place in the syslog-ng source, |
8 |
>>> in modules/systemd-journal/journal-reader.c: |
9 |
>>> |
10 |
>>> static inline gboolean |
11 |
>>> __seek_to_saved_state(JournalReader *self) |
12 |
>>> { |
13 |
>>> JournalReaderState *state = |
14 |
>>> persist_state_map_entry(self->persist_state, self->persist_handle); |
15 |
>>> gint rc = journald_seek_cursor(self->journal, state->cursor); |
16 |
>>> persist_state_unmap_entry(self->persist_state, self->persist_handle); |
17 |
>>> if (rc != 0) |
18 |
>>> { |
19 |
>>> msg_warning("Failed to seek to the cursor", |
20 |
>>> evt_tag_str("cursor", state->cursor), |
21 |
>>> evt_tag_errno("error", errno), |
22 |
>>> NULL); |
23 |
>>> return __seek_to_head(self); |
24 |
>>> } |
25 |
>>> journald_next(self->journal); |
26 |
>>> return TRUE; |
27 |
>>> } |
28 |
>>> |
29 |
>> |
30 |
>> The other posts are getting at the solution - disable journal support |
31 |
>> if you're not actually using systemd. |
32 |
>> |
33 |
>> However, does syslog-ng actually READ logs? My understanding is that |
34 |
>> journal cursors are used to read logs, not to write them, and I |
35 |
>> associate syslog-ng more with writing logs. |
36 |
>> |
37 |
>> The concept is that when you query the journal every record gets |
38 |
>> returned with a cursor, which is just a guid of some sort. Then you |
39 |
>> can run a later query and pass the last cursor you saw back and just |
40 |
>> get a list of new records since the last one you read. The use case |
41 |
>> is for log monitors and such so that they can periodically poll the |
42 |
>> log without having to read the entire thing from the beginning each |
43 |
>> time. |
44 |
>> |
45 |
> |
46 |
> |
47 |
> Digging up ancient memory from other people's posts long ago: |
48 |
> |
49 |
> Doesn't syslog-ng read systemd's log from early userspace startup |
50 |
> (before syslog-ng starts) and write those entries to syslog-ng? |
51 |
> |
52 |
|
53 |
Ah, that makes sense. This isn't about recording syslog data in the |
54 |
journal. This is about recording journal data in syslog, for which |
55 |
using cursors would be a completely obvious design. |
56 |
|
57 |
-- |
58 |
Rich |