[systemd-devel] journal and /run/systemd/journal/syslog

[Umut Tezduyar]

Hi,

I have noticed that if journal fails to send messages to
/run/systemd/journal/syslog, it increments a counter and every 30
seconds it prints out a message on journal informing that forwarding x
many messages has failed. If journal storage is set to none, there is
no way of being informed about the missing messages. Should we not try
to send a message to /run/systemd/journal/syslog if/when it has space
again?

syslog.socket sets ReceiveBuffer=8M. My understanding is intention of
setting this value is specifying the maximum size of one datagram
message that is allowed to send. socket.c is setting the SO_RCVBUF on
the socket. According to man unix 7, SO_RCVBUF has no effect on the
datagram but SO_SNDBUF does. Am I missing something?

Number of messages that can be queued on /run/systemd/journal/syslog
is controlled by /proc/sys/net/unix/max_dgram_qlen and this value is
by default 10 in most distributions. What this means is, after journal
forwards 11 messages to the socket, it will not be able to do so until
external logging daemon comes up and clears up
/run/systemd/journal/syslog. If logging daemon is starting after
basic.target, it is pretty certain that it will not be able to receive
all the early boot messages. Increasing
/proc/sys/net/unix/max_dgram_qlen is an option but is increasing a
system wide limit right thing to do?

Thanks