[systemd-devel] systemd-journald doesn't follow max datagram length when forwarding messages to syslog

[Lennart Poettering]

On Sun, 10.08.14 21:07, Umut Tezduyar Lindskog (umut at tezduyar.com) wrote:

> The problem is due to sending socket's SO_SNDBUF limit. My guess at
> this point is the amount of messages you can queue to syslog socket is
> determined by 3 factors. a) Sending socket's SO_SNDBUF b) Receiving
> socket's SO_RCVBUF c) Global variable
> /proc/sys/net/unix/max_dgram_qlen.
> 
> My workaround is adding SendBuffer=8M to
> systemd-journald-dev-log.socket but I am not sure if the way we
> account things is intuitive. My propose is passing
> systemd-journald-dev-log.socket to systemd-journald so that
> systemd-journald can forward messages to rsyslog through it. Or not
> deal with this since newer rsyslog fetches logs.
> 
> References
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/net/unix/af_unix.c#n1445
> http://vger.kernel.org/~davem/skb_sk.html

I have now changed git to also set SendBuffer=8M for the .socket unit.

I must agree though, it's a bit surprising that we use the same socket
here for recieving syslog and forwarding it. 

I was tempted to just add a second socket for the forwarding, that is
internal to journald, and never seen outside. While this appears
"cleaner" on one hand, it also would require us to either hardcode the
buffer size or come up with a new config setting for it. Neither of
these options are particularly attractive, in particular given that we
can currently just set SendBuffer=8M and be done with it. Hence that's
what I did.

Does that make sense?

Lennart

-- 
Lennart Poettering, Red Hat