[systemd-devel] live remote logging?

[Mirco Tischler]

2012/10/31 Cliff Brake <cliff.brake at gmail.com>:
> Hello,
>
> I've come up with several ideas:
>
> 1) scp/rsync the journal files to the server.
>    * how do we know when a file is ready to be scp'd?
>    * is there any way to get reasonable update rate?  It seems running rsync
> every 10s might get expensive.
Each time an entry is added, you need to copy the whole file. This
would only work for static, already rotated files.

> 2) use the systemd-journal-gatewayd in v195
>    * is there any way to stream the journal with this, or is this more of a
> query interface?
>    * I assume, we then we loose the journal file format
>
> 3) write our own app that monitors the journal and copies over data
>    * how would this operate, would we use mmap + file change notifications,
> or journal C api?
>    * with mmap, would we watch all the files in the journal directory?
>
> 4) wait for the live remote logging features
>    * any timeline for when this will be available?
>
> 5) run syslog along side journal and use the syslog network logging features
>    * then the anti-systemd members of the team say -- why don't we just
> ditch systemd and go back to sysvinit and syslog ...  :-)
>    * then we lose the query benefits of the journal on the server.
>
6) nfs mount either the server's /var/log/journal over the clients
/var/log/journal, or all of the
clients /var/log/journal/<machine-id>s into the server's /var/log/journal.

> Additionally, on the server, it seems like it makes sense to use the journal
> files for the log storage.
>   1) how would log rotation be managed (discard old logs)?
systemd does log rotation based on available disc space, in order to
keep a maximum of log entries.
It rotates logs when they grow beyond a certain limit, and when a
maximum of disk space is used deletes the oldest file.
The options to configure this and default values are explained in the
journald.conf man page.

>   2) can the systemd-journal-gatewayd be used on a independent directory of
> log files?
systemd-journal-gatewayd doesn't take any arguments, so it currently
seems not possible.
>
> Appreciate any ideas.
>
> Thanks,
> Cliff

Mirco