[systemd-devel] Journald : from initialramfs to real root

[Thomas HUMMEL]

On 2/25/25 6:57 AM, Mantas Mikulėnas wrote:

Hello,

thanks for your answer.

> These seem like rsyslogd has picked them up directly from the kernel (from
> the legacy /proc/kmsg guessing from the format) and not from the journal.
> Systemd-journald loads kernel logs via /dev/kmsg which wouldn't have the
> [time.stamp] prefix.

hmmm not sure how it's supposed to work. I assume both refer to the same 
ring buffer. Would a reader consume what it reads which would then not 
be in the buffer anymore for the second reader to read ? If so wouldn't 
that be journald first ?
On the contrary, if both reads the same content, I should see kernel msg 
twice on my aggregator

> I believe it just logs to /run/log 

But this seems to go against the fact that intitalramfs journald can 
show intitialramfs systemd units (which dracut services are) logs, no ?

I must dig deeper to figure out how it works.

Thanks for your help

-- 
Thomas HUMMEL
HPC Group
Institut PASTEUR
Paris, FRANCE