[systemd-devel] journald syslog forwarding

"Jóhann B. Guðmundsson" johannbg at gmail.com
Thu Dec 11 08:35:24 PST 2014

On 12/11/2014 04:19 PM, Zbigniew Jędrzejewski-Szmek wrote:
> On Thu, Dec 11, 2014 at 04:09:54PM +0000, "Jóhann B. Guðmundsson" wrote:
>> >
>> >On 12/11/2014 03:31 PM, Zbigniew Jędrzejewski-Szmek wrote:
>>> > >The difference is in how the logs are accessed: if journald itself does the jobs,
>>> > >they would be forwarded "live". If anything else, the uploader would be a client
>>> > >which reads the files in/var/log/journal/. The are advantages to both solutions:
>>> > >the first one might be more robust if writing the logs fails or stops for whatever
>>> > >reason. The second one will probably send more logs, because sending of logs can
>>> > >be delayed until the network is up. In the second version, the uploader can also
>>> > >forward logs from other machines (containers). Now that I spelled it out, the second
>>> > >version seems nicer.
>>> > >
>> >
>> >I'm not quite following what you said there but I would actually
>> >think the former as in "forward it live" is better, ju
> Journal carries messages from the initramfs. We cannot send them from
> the initramfs, unless we bring up the network then, which we don't want
> to do just for this purpose. But those messages are stored in /run/log,
> and then flushed to /var/log, and the uploader tool can forward them
> after the network is established.

Right but I thought that might be controlled via socket and once the 
network would become available it would dump the content of the socket 
buffer on the wire...


More information about the systemd-devel mailing list