[systemd-devel] Why is journalctl -b so slow?

[Lennart Poettering]

On Fr, 20.11.20 10:39, Ulrich Windl (Ulrich.Windl at rz.uni-regensburg.de) wrote:

> Hi!
>
> journactl -b is quite fast to display the first lines, but when I
> want to see the last lines, it's quite slow.

How to you jump to the last lines? You are in "less" (i.e. the usual
auto-paging) and press <End>?  If so, the full journal needs to be
streamed to less first. That is necessarily slow if you have a lot of
log data, since it all needs to be read into memory, passed to less
which then buffers it again, counts lines and finds the "end" of it).

> The journal is on BtrFS
> that is on a hardware RAID made from two SSDs, so the _filesystem_
> should not be the problem (actually it seems the journal is in tmpfs
> actually):

Performance deteriorates with the number of journal files. There are
some O(n)'isms with the number of journal files currently. These
should be addressable though, but so far noone spent the time on this
(i.e. we can move a tiny bit more information from the file contents
into the file name so that we don't have to even open the files to be
able to know where they belong in the chronology of things)

btrfs makes things a lot worse btw, since the write pattern we employ
that are very unfriendly to CoW file systems (i.e. we do random
writes; CoW file systems can't really handle anything that aren't
linear writes). In upstream defaults we thus turn off cow for these
files, not sure if your distro undoes that though.

Lennart

--
Lennart Poettering, Berlin