[systemd-devel] [RFC] split journal by loglevel

[Lennart Poettering]

On Tue, 22.10.13 16:45, Łukasz Stelmach (l.stelmach at samsung.com) wrote:

> Hello Everyone.
> 
> <rant>
> Some of you may know I and my colleagues work hard to make Tizen work
> for you.
> </rant>

Rant? Hmm?
> 
> Tizen is growing really fast and we've got a problem. A lot of code
> produce a lot of messages. Some of them are more important than others.
> We want to access debug (and info) messages when a system is working and
> we don't want to keep them accross rebots. The obvious solution is to
> split messages into two journal files based on log-level.  Less
> important messages would be saved in /run/log/journal more important
> ones in /var/log/journal.

Sounds like a useful feature!

> 
> RFC.
> 
> As obvious as the desired result occurs I am not sure what is the best
> place to hook and configure it. Is it another keyword (or set of
> keywords) for SplitMode: level (level+uid, level+login (level+none?))?
> Or maybe something around MaxLevelStore and line 836 of
> journald-server.c[1]?

I am tempted to suggest to add a new value to Storage=, maybe called
"level" or so? And then add a new switch StoragePersistentLevel= which
is only interpreted when Storage= equals "level" or if it equals "auto"
and /var/log/journal actually exists. 

> 
> RFC.
> 
> There is yet another way I can think of: log everything to /run and
> filter out everything below certain log-level. This solution however may
> incur moments heavy load on systems during log rotation.
> 
> RFC.
> 
> Please give me some clues.

We currently operate on the runtime journal only if the system journal
is not open. If we keep both open we need to start working on both all
the time. I figure this means a number of changes in journald-server.c,
but most of them should be fairly straightforward...

Lennart

-- 
Lennart Poettering, Red Hat