[systemd-devel] [ANNOUNCE] Journal File Format Documentation

[Ciprian Dorin Craciun]

On Tue, Oct 23, 2012 at 9:40 PM, Lennart Poettering
<lennart at poettering.net> wrote:
> But note that the price you pay for interleaving files on display grows
> with the more you split things up (O(n) being n number of files to
> interleave), hence we are a bit conservative here, we don't want to push
> people towards splitting up things too much, unless they have a really
> good reason to.

    By "interleaving" I guess you mean: when querying for logs the
system will have to open all files and read from them at the same time
to give the impression of a "merged" log, sorted by timestamp (or a
similar key).

    In this case in my use-case this is not an issue, as the
"real-time" logs are required for a particular "process", and not for
the entire "system".


> BTW, are you sure you actually need processes to split up by? Wouldn't
> services be more appropriate?

    When I say "processes" I actually mean: a couple of processes
acting together as an integral logical unit. (Like PostgreSQL which
has multiple processes which behave as one group.)

    And the way I see benefiting from systemd would be creating
containers (like LXC) for each such "process".


>>     As such, wouldn't a "clustering" key (like service type, or
>> service type + pid, etc.) would make sense? This would imply:
>>     * splitting storage based on this "clustering key"; (not
>> necessarily one per file, but maybe using some consistent hashing
>> technique, etc.)
>>     * having the clustering key as a parameter for querying to
>> restrict index search, etc.
>
> Not sure I grok this.

    By "cluster key" I mean a special key that would direct the entry
to one log file or another. In the "normal" case such a "cluster key"
would be the login user name, etc. (This would also allow events from
the same source endup in different log files based on this "key".)

    In one word: a way to partition entries into multiple log files,
by setting this special field.