[systemd-devel] Check from several machines on one machine

[Colin Guthrie]

'Twas brillig, and Cecil Westerhof at 28/11/13 23:40 did gyre and gimble:
> With rsyslog you can send everything to one machine and evaluate the
> logs of several machines on that one machine. As I understand it,
> journald is mend to work locally. Is there a way to centralize the usage
> of journals? This could be done with rsyslog, but then you lose all the
> benefits of journald.


So there are several options with the journal. The
systemd-journal-gateway is one option, but you can also do basic
filesystem stuff with journals too. e.g. if you share the
/var/log/journal folder via NFS, you can mount these on one machine.
e.g. each machine uses a machine-id folder for it's journals (see.
/etc/machine-id and "man 5 machine-id"), so all you do is mount
/var/log/journal/6cb2a4b2bf6df044e57da8a5000001e4 (and other examples).
You can then use the "journalctl -m" option to merge all these journals
into one view.

Note that for containers, if you start a containerised "machine" via
systemd-nspawn with the -j option, it will automatically create the
appropriate /var/log/journal/NNNN folder for you such that these can be
easily merged in to the host!

HTHs

Col


-- 

Colin Guthrie
gmane(at)colin.guthr.ie
http://colin.guthr.ie/

Day Job:
  Tribalogic Limited http://www.tribalogic.net/
Open Source:
  Mageia Contributor http://www.mageia.org/
  PulseAudio Hacker http://www.pulseaudio.org/
  Trac Hacker http://trac.edgewall.org/