[systemd-devel] journal handling of process title changes

[Lennart Poettering]

On Sun, 23.03.14 00:32, Patrick Donnelly (batrick at batbytes.com) wrote:

> It seems the journal is reading from /proc/pid/cmdline (argv[0]) for
> each entry. So when reading using journalctl, we don't see process
> title changes properly. See the below example:

We are reading both /proc/$PID/comm and /proc/$PID/cmdline, and augment
journal entries with that. Unfortunately the kernel is currently too
limited to do this in a race-free way. This means that a service that
logs and terminates quickly afterwrads will trigger a race: journald
won't be able to read comm and cmdline in time. Also, if you keep
changing the comm/argv lines then we might use a later comm/argv for
messages already written long before since we only read this data much
later...

> 
> #include <sys/prctl.h>
> #include <systemd/sd-journal.h>
> 
> int main (int argc, char *argv[])
> {
>     printf("%d\n", prctl(PR_SET_NAME, "foo", 0, 0, 0));
>     sd_journal_print(LOG_INFO, "hi");
>     strcpy(argv[0], "abc");
>     sd_journal_print(LOG_INFO, "bye2");
>     return 0;
> }
> 
> gcc test.c -o a.out -lsystemd
> ./a.out
> 
> we see:
> 
> ... a.out[10321]: hi
> ... a.out[10321]: bye
> ... c[10321]: bye2
> 
> I don't see how after a cursory glance at the code, but systemd is
> also magically remembering the "old" beginning of argv[0]. So, even if
> I change argv[0], I must start my changes from the beginning of the
> basename of the old title. So in the above example, "ab" replaced "./"
> in argv[0], only "c" is printed in the log.
> 
> It seems to me systemd should be using /proc/pid/comm for this.

And we do. Can you please dump the respective lines with "-o verbose"
from the journal? They should explain in detail what we are seeing
there...

Lennart

-- 
Lennart Poettering, Red Hat