[systemd-bugs] [Bug 64296] journalctl --since $DATE contains entries from before $DATE

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=64296

--- Comment #4 from Clemens Buchacher <drizzd at aon.at> ---
I appear to suffer from the same problem, or multiple problems. In addition to
journalctl showing old messages, the messages are also interleaved with newer
messages.

This is with latest master: v205-133-gc72aadd

I see the problem only as root. Even if the journal files are readable to the
current user, as a normal user I cannot reproduce this behavior.

FWIW, I had a kernel panic on Jul 17 between 17:26 and 14:33, which is why I am
looking at the logs.

I cannot post my raw journal here because it contains sensitive information. Is
it possible to decode them to plain-text, such that I can strip out message
contents, then re-encode them? Or is there some way to replace the message
contents with dummy placeholders?

Do you have any other pointers how to debug this? Is the file format
documented?

$ date
Wed Jul 17 16:45:38 CEST 2013
$ journalctl -D /var/log/journal/7077725e2734c7b16dbbe92a00000b89/
--since="2013-07-17 14:33:24" | head -20
-- Logs begin at Sat 2012-10-20 15:23:13 CEST, end at Wed 2013-07-17 17:08:58
CEST. --
Jul 17 14:33:24 [...]
Jul 17 14:33:25 [...]
-- Reboot --
Jun 15 10:28:50 [...]
-- Reboot --
Jul 17 14:33:25 [...]
-- Reboot --
Jun 15 10:28:50 [...]

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/systemd-bugs/attachments/20130717/d449da7c/attachment.html>