[systemd-devel] Journald : from initialramfs to real root

[Mantas Mikulėnas]

On Mon, Feb 24, 2025 at 10:25 PM Thomas HUMMEL <thomas.hummel at pasteur.fr>
wrote:

> Hello,
>
> I'm running systemd-239-74 on RHEL 8.8. EUS.
> I'm using dracut initialramfs running systemd to PXE boot stateless
> compute nodes.
>
> In real-root image, journald is set up to forward to syslog
> (ForwardToSyslog=yes) which is handled by rsyslogd to aggregate on a log
> server logs from nodes.
>
> So I can see in those logs kernel booting messages (starting with
>
> kernel: [    0.000000] Linux version 4.18.0-477.43.1.el8_8.x86_64
> (mockbuild at x86-vm-07.build.eng.bos.redhat.com) (gcc version 8.5.0
> 20210514 (Red Hat 8.5.0-18) (GCC)) #1 SMP Thu Jan 4 10:30:57 EST 2024
>

These seem like rsyslogd has picked them up directly from the kernel (from
the legacy /proc/kmsg guessing from the format) and not from the journal.
Systemd-journald loads kernel logs via /dev/kmsg which wouldn't have the
[time.stamp] prefix.


> I also sometimes used dracut debug mode and initialramfs journald as
> stated in the man:
>
> " rd.debug
>             set -x for the dracut shell. If systemd is active in the
>             initramfs, all output is logged to the systemd journal, which
>             you can inspect with "journalctl -ab". "
>
> I was wondering :
>
> 1. is initialramfs journald able to somehow handle its logs to actual
> root systemd and if so how ? (my understanding was that, for instance,
> such a mechanism was a reason to use dracut NetworkManager (as opposed
> to legacy module) module if/when using NetworkManger in actual root)
>

I believe it just logs to /run/log and the initramfs needs to carry over
the same /run tmpfs mount to the "real root" phase, where "flush to /var"
picks up both initramfs logs and early rootfs logs at the same time. At
least that's how it seems to work with Arch's systemd-based mkinitcpio
initramfs.


>
> 2. would then initialramfs output also be forwarded to syslog ? Only in
> debug mode ?
>

ForwardToSyslog is not retroactive. You'd need to use the pull method
(rsyslogd's imjournal module) to have it forward old messages.

-- 
Mantas Mikulėnas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/systemd-devel/attachments/20250225/92ba251d/attachment.htm>