[systemd-devel] lost journal persistence

[Lennart Poettering]

On Thu, 15.05.14 17:30, Chris Murphy (lists at colorremedies.com) wrote:

> 
> 
> On May 15, 2014, at 3:58 PM, Lennart Poettering <lennart at poettering.net> wrote:
> 
> > On Sat, 10.05.14 18:02, Chris Murphy (lists at colorremedies.com) wrote:
> > 
> >> So I thought maybe the flush is happening to /var before var subvolume is mounted there, but that's not the case; the reason why it's not empty is due to dhclient always creating one folder prior to var subvolume mounting at /var.
> >> 
> >> /var/lib/dhclient
> > 
> > Hmm, this looks like a bug. Is dhclient invoked before /var is mounted?
> 
> Seems not to be, as the first reported instance of dhclient is
> afterward and /var already has something in it. Maybe NetworkManger
> creates it?

Ther ordering is not really reliable, as journald reads from multiple
streams in parallel and there's no guarantee that it will do so in the
same order as the messages where queued in. This is not fixable unless
all of our transports start sending timestamps along...

> Seems crude but I could figure out how to set an selinux label on the
> wrong /var to prevent anything from creating things there, and see
> what explodes?

maybe use chattr with the immutable flag?

Lennart

-- 
Lennart Poettering, Red Hat