[systemd-devel] Retaining boot messages on (near-)stateless systems

[John Florian]

I maintain a derivative of Fedora Live (built using lorax) that gets
deployed on hundreds of systems, far more than my team has the man-
power to keep a watchful eye.  Occasionally we are notified of a
problematic node and often it would be helpful to see the full journal
for say, the first 15 minutes of run-time in which the node transforms
itself from a generic appliance to a specific role.  Unfortunately, in
many cases we are notified too late and journald has tail-trimmed the
logs we desire most.

Reviewing journald.conf(5) I don't see options to achieve what I want
directly so my thought is to create a service and timer with
OnBootSec=15m to duplicate the journal over to persistent storage,
which would then require non-standard techniques for viewing but at
least the availability would be guaranteed.

Is there a better way to achieve this?  If not, what's the best way to
duplicate the journal data?   Simply cp -a /var/log/journal/ ... or use
journalctl to dump or export it somehow?

I'll also add that I also wish to retain higher priority messages for a
longer period, though for the first ~15m I want everything, DEBUG
included.  That leads me to think about a 2nd logger (journald,
ideally) which had messages forwarded to it, but with different
retention characteristics.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/systemd-devel/attachments/20170511/bdbf39f4/attachment.html>