On Mon, Feb 23, 2015 at 3:41 AM, <cov...@ccs.covici.com> wrote: > > Marc Joliet <mar...@gmx.de> wrote: > > > Am Mon, 23 Feb 2015 00:41:50 +0100 > > schrieb lee <l...@yagibdah.de>: > > > > > Neil Bothwick <n...@digimed.co.uk> writes: > > > > > > > On Wed, 18 Feb 2015 21:49:54 +0100, lee wrote: > > > > > > > >> > I wonder if the OP is using systemd and trying to read the journal > > > >> > files? > > > >> > > > >> Nooo, I hate systemd ... > > > >> > > > >> What good are log files you can't read? > > > > > > > > You can't read syslog-ng log files without some reading software, usually > > > > a combination of cat, grep and less. systemd does it all with journalctl. > > > > > > > > There are good reasons to not use systemd, this isn't one of them. > > > > > > To me it is one of the good reasons, and an important one. Plain text > > > can usually always be read without further ado, be it from rescue > > > systems you booted or with software available on different operating > > > systems. It can be also be processed with scripts and sent as email. > > > You can probably even read it on your cell phone. You can still read > > > log files that were created 20 years ago when they are plain text. > > > > > > Can you do all that with the binary files created by systemd? I can't > > > even read them on a working system. > > > > What Canek and Rich already said is good, but I'll just add this: it's not like > > you can't run a classic syslog implementation alongside the systemd journal. > > On my systems, by *default*, syslog-ng kept working as usual, getting the logs > > from the systemd journal. If you want to go further, you can even configure > > the journal to not store logs permanently, so that you *only* end up with > > plain-text logs on your system (Duncan on gentoo-amd64 went this way). > > > > So no, the format that the systemd journal uses is most decidedly *not* a reason > > against using systemd. > > > > Personally, I'm probably going to uninstall syslog-ng, because journalctl is > > *such* a nice way to read logs, so why run something whose output I'll never > > read again? I recommend reading > > http://0pointer.net/blog/projects/journalctl.html for examples of the kind of > > stuff you can do that would be cumbersome, if not *impossible* with regular > > syslog. > > Except that I get lots of messages about the system journal missing > messages when forwarding to syslog, so how can I make sure this does not > happening?
Could you please show those messages? systemd sends *everything* to the journal, and then the journal (optionally) can send it too to a regular syslog. In that sense, it's impossible for the journal to miss any message. The only way in which the journal could miss messages is at very early boot stages; but with a proper initramfs (like the ones generated with dracut), even those get caught. You get to put an instance of systemd and the journal inside the initramfs, and so it's available almost from the beginning. And if you use gummiboot, then you can even log from the moment the UEFI firmware comes to life. Regards. -- Canek Peláez Valdés Profesor de asignatura, Facultad de Ciencias Universidad Nacional Autónoma de México
