[systemd-devel] Merging journal logs from btrfs snapshots

[Kai Krakow]

Mirco Tischler <mircotischler at gmx.net> schrieb:

> Am 16.01.2014 22:15 schrieb "Chris Murphy" <lists at colorremedies.com>:
>>
>>
>> On Jan 16, 2014, at 1:58 PM, Kai Krakow <hurikhan77 at gmail.com> wrote:
>>
>> > Chris Murphy <lists at colorremedies.com> schrieb:
>> >
>> >> Due to anti-magic, a recent update horribly broke the system's ability
> to
>> >> do further updates. This is resolved by regression to a prior Btrfs
>> >> snapshot, once updated it works fine. But that's a two week old
> snapshot.
>> >> I don't need the broken rootfs but I want to keep the journal for
>> >> those two weeks.
>> >>
>> >> Is this a reasonable want or need and if so how to merge the logs?
> Between
>> >> the two snapshots there are several like named files in
>> >> /var/log/journal/<machine-id>.
>> >
>> > I'd recommend to place /var/log/journal on a subvolume so it is not
> affected
>> > by snapshotting. You can do separate snapshots for it (tho I cannot
> imagine
>> > why you would want to do it). That way you get a snapshot "protection"
> for
>> > these files, too, and you are free to roll back the rest of the system
>> > without affecting this subvolume.
>>
>> Aha, good idea. So then I mount the subvol at /var/log/journal? Is there
> any risk of journald writing to rootfs /var/log/journal before the
> subvolume is mounted? Or is the flush to persistent storage sufficiently
> delayed as to not be a concern?
>>
>> Chris Murphy
>>
> Afair, you don't need to mount subvolumes.

This is only true if you place subvolumes within your rootfs namespace at 
exactly the position you'd normally expect the mount-point at. If you follow 
recommendations, you place every subvolume in the subvol=0 namespace - and 
then you need to mount it.

Like this:

/ [subvol=0]
  rootfs [subvolume]
    var
      log
    ...
  var-log-journal [subvolume]
    ...
  home [subvolume]
    username
    ...

resulting in btrfs-device[subvolid=rootfs] mounted as /, then btrfs-
device[subvolid=var-log-journal] mounted as /var/log/journal

vs. your idea:

subvol=0
/
  var
    log
      journal [subvolume]
        ...
  home [subvolume]
    username
    ...

resulting in btrfs-device mounted as / = no really usage of subvolumes.

But that has some downsides as you cannot easily roll-back your rootfs 
without copying the hole stuff. Even if you roll-back somehow, you may alter 
the subvolume residing in a sub directory of your rootfs. I'd recommend 
against this scheme.

Regards,
Kai