[systemd-devel] Native Journal source vs syslog forwarding

[Gergely Nagy]

>>>>> "Lennart" == Lennart Poettering <lennart at poettering.net> writes:

    Lennart> On Wed, 26.11.14 11:04, Gergely Nagy (algernon at madhouse-project.org) wrote:
    >> This works beautifully, except there's one problem:
    >> 
    >> Nov 26 10:41:05 eowyn systemd-journal[14843]: Forwarding to syslog missed 1343 messages.
    >> 
    >> On Debian, syslog forwarding is enabled by default, and since syslog-ng
    >> reads from the journal, there's nothing listening on
    >> /run/systemd/journal/syslog, and I get spammed with messages like the
    >> one above.

    Lennart> Hmmm, we only increase the counter when we get EAGAIN from the
    Lennart> socket. Normally, if nobody is listening on the other side we
    Lennart> shouldn't get EAGAIN, we should get ECONNREFUSED or so.

    Lennart> Most likely for some reason "syslog.socket" gets started (which
    Lennart> establishes the socket), but nothing is then started behind it? That
    Lennart> sounds wrong.

Yep, it turns out that was the issue. syslog-ng.service had a
Requires=syslog.socket, a left over from an older version which did not
support reading from the journal. It appears that removing that line
disabled starting the socket, and the forwarding errors stopped too.

    Lennart> Note that in systemd upstream we don't do forward-to-syslog anymore,
    Lennart> simply because it turned out to be really slow when nobody is
    Lennart> listening on the socket, and rsyslog didn't use it anymore. Does
    Lennart> Debian turn this on after all?

Yes, because rsyslog (the default syslogd in debian) does not have the
journald reader enabled (or at least, not as a default), as far as I
remember.

-- 
|8]
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 818 bytes
Desc: not available
URL: <http://lists.freedesktop.org/archives/systemd-devel/attachments/20141201/db9f00e2/attachment-0001.sig>