[systemd-devel] Forwarding to syslog missed XX messages

[Reindl Harald]

Am 22.10.2014 um 13:22 schrieb Lennart Poettering:
> On Mon, 15.09.14 13:20, Reindl Harald (h.reindl at thelounge.net) wrote:
>
>> anybody an idea why?
>>
>> Sep 15 13:14:43 localhost systemd-journal[4650]: Forwarding to syslog missed 2 messages.
>> Sep 15 13:15:13 localhost systemd-journal[4650]: Forwarding to syslog missed 196 messages.
>> Sep 15 13:15:44 localhost systemd-journal[4650]: Forwarding to syslog missed 236 messages.
>> Sep 15 13:16:14 localhost systemd-journal[4650]: Forwarding to syslog missed 180 messages.
>> Sep 15 13:16:44 localhost systemd-journal[4650]: Forwarding to syslog missed 323 messages.
>> Sep 15 13:17:15 localhost systemd-journal[4650]: Forwarding to syslog missed 232 messages.
>> Sep 15 13:17:45 localhost systemd-journal[4650]: Forwarding to syslog missed 156 messages.
>
> Apparently syslog forwarding is on but your syslog implementation is
> not capable of keeping up processing the messages quickly enough. Note
> that by default the number of messages that may be queued in the
> syslog socket is relatively low, you can bump it via
> /proc/sys/net/unix/max_dgram_qlen, which would allow more messages to
> be queued so that your syslog implementation has more time to process
> the messages.

i doubt - my homeserver don't log that much

> Why precisely your syslog implementation is too slow is something
> you'd have to debug on the side of theat implementation, we cannot
> determine this from systemd's side.
>
> Note that rsyslog doesn't need the syslog forwarding anymore these
> days, it picks up the messages directly from the journal. You can thus
> turn syslog forwarding off with ForwardToSyslog=no in
> journald.conf. In fact, very recent systemd versions actually changed
> the default here to off, given the fact that rsyslog doesn't need this
> any more

that is in fact the case on all of my machines

so why does systemd-journal complain about missed forwarding at all?

[root at srv-rhsoft:~]$ journalctl  | grep missed
Okt 21 17:30:22 srv-rhsoft.rhsoft.net systemd-journal[551]: Forwarding 
to syslog missed 1 messages.
Okt 21 17:34:46 srv-rhsoft.rhsoft.net systemd-journal[551]: Forwarding 
to syslog missed 10 messages.

[root at srv-rhsoft:~]$ cat /etc/systemd/journald.conf
[Journal]
Storage=volatile
Compress=yes
RateLimitInterval=10s
RateLimitBurst=5000
RuntimeMaxUse=10M
ForwardToSyslog=no

[root at srv-rhsoft:~]$ cat rsyslog.conf
$ModLoad imjournal
$MainMsgQueueSize 30000
$WorkDirectory /var/lib/rsyslog
$IMJournalStateFile imjournal.state

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freedesktop.org/archives/systemd-devel/attachments/20141022/6e872d46/attachment.sig>