[systemd-devel] A way to better integrate rsyslog into systemd?

[Lennart Poettering]

On Sat, 04.10.14 00:32, Aleksei Besogonov (alex.besogonov at gmail.com) wrote:

> However, one of our clients raised an a question about forwarding
> overhead. It turns out that it’s definitely non-trivial and can in
> some cases cause significant slowdowns during log-heavy
> events. Think about 400Mb/s of logs - most of them are filtered out
> by rsyslog locally and some are transmitted over the network for
> permanent storage.
>
> So they would like to turn off the journald intercepting /dev/log,
> but only for specific services. I think that socket forwarding seems
> to be the easiest way to implement it. I’m going to actually do it
> and send patches for approval, if systemd developers don't object in
> principle or unless somebody proposes a better alternative.

I'd really prefer if we could try to fix any remaining issues in
journald, and make it scale better, if it doesn't scale that well
yet. We already did some improvements a while back with caching more
metadata, but I am sure we can make things even better (for example,
if we had SCM_CGROUPS and stuff in the kernel, we could get rid of a
number of kernel calls for each log message.

Lennart

-- 
Lennart Poettering, Red Hat