[systemd-devel] Journal message timestamps

[Lennart Poettering]

On Mo, 07.09.20 14:12, Mantas Mikulėnas (grawity at gmail.com) wrote:

> > To fix that we'd have to keep a separate log of boot ids or so
> > somewhere, which we could use as auxiliary source of truth if all we
> > have are bootids+monotonic time which came first by comparing boot
> > ids. But that would still not be perfect since we could write that out
> > only late (i.e. after /var becomes writable), so the order before that
> > could not be reconstructed either if the system doesn't get that far.
>
> Hmm, but if there's no /var in which to store the append-only log of boot
> IDs, then there's also no /var in which journal messages would persist
> either, is there? So one wouldn't be seeing messages from previous boots
> anyway.

Well, during early boot /var might not be available but during later
boot it might and we might flush the logs from early boot into it
then.

> Also, if /var *is* available, didn't .journal files also have some sort of
> global sequence number that could be used when timestamps fail?

It does, but we can't use that during early boot, hence all early boot
messages come without a seqno that would be useful for this.

Basically: before the /var flush we'll use one series of seqnos, and
after the /var flus another series of seqnos. The latter will be a
persistent series, i.e. every log message generated after the /var
will have a globally monotonic seqno. But the stuff from before the
/var will have a different series of seqno on each boot, and it good
enough to compare log record order for recrods of the same boot, but
not of different boots.

Lennart

--
Lennart Poettering, Berlin