[systemd-devel] Antw: [EXT] Re: Why is journalctl -b so slow?

[Ulrich Windl]

>>> Lennart Poettering <lennart at poettering.net> schrieb am 19.12.2020 um 13:34
in
Nachricht <20201219123435.GJ48346 at gardel-login>:
> On Fr, 20.11.20 10:39, Ulrich Windl (Ulrich.Windl at rz.uni‑regensburg.de)
wrote:
> 
>> Hi!
>>
>> journactl ‑b is quite fast to display the first lines, but when I
>> want to see the last lines, it's quite slow.
> 
> How to you jump to the last lines? You are in "less" (i.e. the usual
> auto‑paging) and press <End>?  If so, the full journal needs to be

I press 'G' ;-)

> streamed to less first. That is necessarily slow if you have a lot of
> log data, since it all needs to be read into memory, passed to less
> which then buffers it again, counts lines and finds the "end" of it).
> 
>> The journal is on BtrFS
>> that is on a hardware RAID made from two SSDs, so the _filesystem_
>> should not be the problem (actually it seems the journal is in tmpfs
>> actually):
> 
> Performance deteriorates with the number of journal files. There are
> some O(n)'isms with the number of journal files currently. These
> should be addressable though, but so far noone spent the time on this
> (i.e. we can move a tiny bit more information from the file contents
> into the file name so that we don't have to even open the files to be
> able to know where they belong in the chronology of things)
> 
> btrfs makes things a lot worse btw, since the write pattern we employ
> that are very unfriendly to CoW file systems (i.e. we do random
> writes; CoW file systems can't really handle anything that aren't
> linear writes). In upstream defaults we thus turn off cow for these
> files, not sure if your distro undoes that though.

At the time being, the journal was in tmpfs only. It seems the problem might
be either:
Many very similar messages repeating in groups (like A, B, C, A, B, C, ...)
Related to Unicode processing (There exists a similar slowness in "wc")

Regards,
Ulrich

> 
> Lennart
> 
> ‑‑
> Lennart Poettering, Berlin