[systemd-devel] [ANNOUNCE] Journal File Format Documentation

[Lennart Poettering]

On Tue, 23.10.12 22:27, Ciprian Dorin Craciun (ciprian.craciun at gmail.com) wrote:

> >>     In one word: a way to partition entries into multiple log files,
> >> by setting this special field.
> >
> > As mentioned we have SplitMode= for this, but it is strictly for UIDs
> > only, since we only need this for access control management, nothing
> > else.
> 
>     This could be another solution to my problem. Allocate a different
> UID to each service.

This is what the Pantheon folks are doing. Instead of running full OSes
in their containers they run large number of sandboxes services (using
systemd's sandboxing logic), each under a UID of their own.

> > Why precisely do you want to split up your log files per-service? That's
> > the bit I don't get.
> 
>     Because in the envisaged PaaS, you have components (services)
> starting and stopping. Thus I want to be able to easily just remove
> logs for dead services, or maybe just move them to a different
> "archival" service where they get deleted after a period of time.
> 
>     It's purely for administrative purposes. Maybe even to allow the
> user to download these log files independently.
> 
>     But I understand now how to best solve this requirement without
> touching the core journald.

Well, but with the journal you can easily filter by
service. i.e. "journalctl -u foobar" will give you a stream that only
includes messages form service "foobar", but it will look otherwise like
/var/log/messages looked.

So, unless you have access mode restrictions or really really need to
make sure that as soon as a container goes away its logs go away too you
could just leave everything in a one pool and then filter on
display/download.

BTW, you with systemd 195 you can do this:

<snip>
systemctl enable systemd-journal-gatewayd.socket
wget http://localhost:19531/entries?_SYSTEMD_UNIT=foobar.service
</snip>

And this will give you all messages from foobar.service easy for
download, even from another host. Or use:

wget --header="Accept: application/json" http://localhost:19531/entries?_HOSTNAME=waldo

And you'll get a JSON formatted dump of all messages for host/container
waldo. And you can easily process that then from your web app to present
a per-container log stream to the user.

Lennart

-- 
Lennart Poettering - Red Hat, Inc.