<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="DE" link="blue" vlink="purple"> <div class="WordSection1"> <p class="MsoNormal"><span lang="EN-US" style="color:#1F497D;mso-fareast-language:EN-US">Well,<o:p></o:p></span></p> <p class="MsoNormal"><span lang="EN-US" style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p> <p class="MsoNormal"><span lang="EN-US" style="color:#1F497D;mso-fareast-language:EN-US">I had almost 3 minutes, and someone else from SLES support testing hat 20 minutes to read the logs on SSD. SLES support was able to speed up thing by a factor of 500 or so. However I don’t know what they did. I guess the update will be published soon.<o:p></o:p></span></p> <p class="MsoNormal"><span lang="EN-US" style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p> <p class="MsoNormal"><span lang="EN-US" style="color:#1F497D;mso-fareast-language:EN-US">Kind regards,<o:p></o:p></span></p> <p class="MsoNormal"><span lang="EN-US" style="color:#1F497D;mso-fareast-language:EN-US">Ulrich Windl<o:p></o:p></span></p> <p class="MsoNormal"><span lang="EN-US" style="color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p> <div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt"> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm"> <p class="MsoNormal"><b>From:</b> systemd-devel <systemd-devel-bounces@lists.freedesktop.org> <b>On Behalf Of </b>Mantas Mikulenas<br> <b>Sent:</b> Saturday, June 28, 2025 11:49 AM<br> <b>To:</b> Gunnar Guðvarðarson <gunnar@meh.is><br> <b>Cc:</b> systemd-devel@lists.freedesktop.org<br> <b>Subject:</b> [EXT] Re: [systemd-devel] Changing database formats for systemd-journald<o:p></o:p></p> </div> </div> <p class="MsoNormal"><o:p> </o:p></p> <div style="mso-element:para-border-div;border:solid black 1.0pt;padding:0cm 0cm 0cm 0cm;background:#FFF3CD"> <p style="background:#FFF3CD;border:none;padding:0cm"><span style="font-size:9.0pt;font-family:Roboto;color:black">Sicherheits-Hinweis: Diese E-Mail wurde von einer Person außerhalb des UKR gesendet. Seien Sie vorsichtig vor gefälschten Absendern, wenn Sie auf Links klicken, Anhänge öffnen oder weitere Aktionen ausführen, bevor Sie die Echtheit überprüft haben.</span><o:p></o:p></p> </div> <div> <div> <p class="MsoNormal">On Thu, Jun 26, 2025 at 6:27 PM Gunnar Guðvarðarson <<a href="mailto:gunnar@meh.is">gunnar@meh.is</a>> wrote:<o:p></o:p></p> </div> <div> <blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm"> <div> <div> <p class="MsoNormal">I have attempted to use systemd-journald as a centralized log collector, it works fine and the interface provided by journalctl is very convenient to quickly find things, following logs and other things.<br> <br> But I quickly discovered the performance implications of doing so, as when the journal gets over a certain size, it practically ceases to function.<br> <br> See <a href="https://github.com/systemd/systemd/issues/2460" target="_blank">https://github.com/systemd/systemd/issues/2460</a> for details.<o:p></o:p></p> </div> </div> </blockquote> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">"Takes 50 seconds to display logs" is slow, yes, but that's nowhere near the same as "practically ceases to function"?<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm"> <div> <div> <p class="MsoNormal"><br> This makes rsyslog's omjournal, and systemd-journal-remote basically useless, right?<br> <br> So, serious question, can the journal be migrated to a better (indexed?) database format, for example SQLite?<o:p></o:p></p> </div> </div> </blockquote> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">Maybe it could, but journal entries do not have fixed columns (except for timestamps and seqnum), so you wouldn't have one neat SQL table of entries – you'd probably end up with a large <id, fieldname, value> "pile of attributes" table and I'm not sure if that would perform any better. (The current format *is* indexed – each field has its own index, not just specific ones.) I think the journal is closer to a "wide-column store" or "NoSQL database" than a traditional SQL database? I'm not even close to being knowledgeable in this topic, though.<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">But I'm not sure if a format change would help on HDDs, anyway... I have a small project that involves a ~10 GB SQLite database on an HDD, and it too sometimes takes minutes to perform the first query from cold cache (long enough that I had to extend the web server's request timeouts).<o:p></o:p></p> </div> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> </div> </div> </div> </div> </body> </html>