On Wed, 26.11.14 11:04, Gergely Nagy ([email protected]) wrote:
> Hi! > > I have an interesting situation here, which I'm trying to wrap my head > around and solve. The problem is that I have a syslog daemon (syslog-ng > 3.6.1) that has a native Journal source, meaning it can pull entries > from the Journal directly, and does not need the syslog forwarding > socket - and this is the default when running on a systemd-enabled > machine. > > This works beautifully, except there's one problem: > > Nov 26 10:41:05 eowyn systemd-journal[14843]: Forwarding to syslog missed > 1343 messages. > > On Debian, syslog forwarding is enabled by default, and since syslog-ng > reads from the journal, there's nothing listening on > /run/systemd/journal/syslog, and I get spammed with messages like the > one above. Hmmm, we only increase the counter when we get EAGAIN from the socket. Normally, if nobody is listening on the other side we shouldn't get EAGAIN, we should get ECONNREFUSED or so. Most likely for some reason "syslog.socket" gets started (which establishes the socket), but nothing is then started behind it? That sounds wrong. Note that in systemd upstream we don't do forward-to-syslog anymore, simply because it turned out to be really slow when nobody is listening on the socket, and rsyslog didn't use it anymore. Does Debian turn this on after all? > 3) Disable syslog forwarding if syslog-ng is installed > > Not sure how this could be achieved, because journald.conf does not > belong to the syslog-ng package, therefore I can't fiddle its > settings from there. (Technically, I could, but I won't, that'd be > extremely rude.) We really should figure out why journald gets EAGAIN when writing to that socket. Is syslog.socket started? If so, why? Lennart -- Lennart Poettering, Red Hat _______________________________________________ systemd-devel mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/systemd-devel
