Rich Freeman posted on Wed, 25 Feb 2015 07:13:03 -0500 as excerpted: > On Wed, Feb 25, 2015 at 5:13 AM, Duncan <1i5t5.dun...@cox.net> wrote: >> >> a) If the system crashes, partially corrupted in-the-crash text logs >> can be of at least some use after a reboot. Binary journals, not so >> much. > > Have you tested this, or found some other data to support this? I think > that journalctl does parse truncated files.
I believe I've seen posts to that effect on the btrfs list (my biggest non-gentoo participation). Note that journald does rotation of I believe 8 journal files by default, and ideally, it'd only be the last one chewed up. Also, cleanly truncated is one thing; file-system-corrupted so it ends up with a piece of some other totally different file in it (as most more modern filesystems take pains to prevent, at least on Linux, as the other file might be from another user and that ends up being a security risk, so modern filesystems generally zero-truncate it if they think it might be corrupted in that manner) is something entirely different. However, fair point. My support on this bit /is/ a bit fuzzier than I'd like. Thanks for pointing that out, to me as well. =:^) >> But syslog-ng lets me dump them without ever actually logging them, or >> route them to a different log file if I prefer, keeping my primary logs >> clean. =:^) > > I was thinking about this and another advantage of split log files is > that you could have different rotation/retention policies for each. I > believe journald's log rotation is one-size-fits-all. I believe so... because everything journald logs (well, everything system, user session logs are I'm pretty sure treated separately, at least with persistent storage enabled, there's a note somewhere in the documentation that if volatile-only is set, journald throws user journals in with the system journals too, which implies it doesn't, with persistent storage) is thrown in the same log, so there's little choice on rotation strategy. But of course syslog-ng allows you to split the logs however you want, and route individual log messages to one or more logs. And those logs in turn can be rotated on entirely different policies. Thanks for that point too. I'm so used to thinking in terms of being able to split logs and setup individual logrotate policies for them, I hadn't even considered that implication of the common journald journals. -- Duncan - List replies preferred. No HTML msgs. "Every nonfree program has a lord, a master -- and if you use the program, he is your master." Richard Stallman
