[systemd-devel] journal repair

[Lennart Poettering]

On Fri, 19.09.14 10:00, Jóhann B. Guðmundsson (johannbg at gmail.com) wrote:

> Is the plan to introduce an repair switch or is the plan to inform the users
> how they should proceed if that is not the case since users are getting
> confused when they encounter journal errors like these
> 
> Data object missing from hash at entry...
> Data object references invalid entry at...
> Invalid tail monotonic timestamp...
> Invalid object contents at...
> File corruption detected at...
> etc.
> 
> And are wasting their time on the internet searching for means to fix those
> errors.
> 
> I think we need to somehow provide the end user with the next step once a
> corruption of anykind has been detected in the relevant journal file even if
> it's just.
> 
> "FAIL: corruption detected, your logs are fucked delete the file."

There isn't really any point in deleting them. journalctl salvages
automatically everything it can when reading them. Since the files are
mostly append-only the corruptions usually only affect half-written
entries at the end, and hence all earlier once should just work.

I am pretty sure we simply need to document this in more detail, and
clarify that corrupted journal files are nothing to act on, and the
journalctl recovers what it can on read, implicitly, with no fsck-like
tool being necessary, and without requiring people to manually delete
anything.

Lennart

-- 
Lennart Poettering, Red Hat