[systemd-devel] Prefix for direct logging

[Mantas Mikulėnas]

On Mon, Sep 27, 2021 at 1:11 PM Arjun D R <drarjun95 at gmail.com> wrote:

> Hi Folks,
>
> Currently we are using systemd-journald for service logging. We run
> journalctl for a bunch of services and redirect those to the custom log
> files for every few seconds. This takes up the CPU for that particular
> time period since we have lot of IO operations as well. We came to know
> that systemd version v236+ supports direct logging
> (StandardOutput:file:<log_file>) to the custom log file by the service. I
> would like to use that facility but we don't get the prefix that we used to
> get when using the journal.
>
> Is there a way to prepare a custom patch locally to add the necessary
> prefix to the stdout before writing to the custom log file? Is that a good
> idea? Any other suggestions?
>

Probably not easily, as it's not systemd that is writing to the log file –
it's your service process itself that directly gets a FD for the log file
as its stdout. It's not specifically a "direct logging" feature, but rather
just an equivalent to `myservice > log_file`.

How do you currently get the logs "every few seconds"? Instead of repeated
grabbing, have you tried using `journalctl --follow` to monitor logs
continuously? This should use far less I/O than repeated `journalctl |
tail` which is what it sounds like you're doing. (Wrap in `stdbuf -o0` if
necessary.)

Alternatively, set up the traditional rsyslogd or syslog-ng – writing to
custom log files is basically what they *do*, and both of them are capable
of receiving logs from journald (either by directly monitoring .journal
files or by having the messages forwarded via socket).

-- 
Mantas Mikulėnas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/systemd-devel/attachments/20210927/ce47bd3d/attachment.htm>