[systemd-devel] /var/log/journal/

[Lennart Poettering]

On Mon, 08.04.13 14:16, Reindl Harald (h.reindl at thelounge.net) wrote:

> > "none" turns off the journal's storage entirely, in which case it is
> > still highly useful for forwarding all logs from STDOUT/STDERR of the
> > various daemons to syslog, but won't store anything at all
> > anymore. "systemctl status" won't show you any log entries in this
> > case, and "journalctl" will show nothing but a big void.
> 
> is it possible to configure "forwarding all logs from STDOUT/STDERR
> to syslog" globally without care of the daemons systemd-units?

Not following. That's the default. You don't have to configure anything
for that. The journal will always forward all logs to syslog, regardless
whether they have been collected via the native journal API, via
/dev/log or read from any service's stdout/stderr output.

> > "volatile" will still allow the journal to log into a small ring buffer
> > in /run. In this case "systemctl status" and "journalctl" will show a
> > bit of useful log data still (as on F17, F18), but the logs are quickly
> > rotated away usually, since /run is relatively small. This means
> > "systemctl status" might be useful shortly after executing commands on
> > the service, but that's it
> 
> personally i would perfer "none" if the above is possible and stick
> completly at rsyslog because a lot of filters and redirects in use

Hmm? I cannot parse this.

You cannot use "none" and expect "systemctl status" to generate any
useful log output for you. Classic syslog is not indexed, so doing such
a look-up is impossible. That's precisely why the journal exists in the
first place.

Lennart

-- 
Lennart Poettering - Red Hat, Inc.