On Wed, Jul 10, 2013 at 10:25 AM, Jonny Törnbom <[email protected]>wrote:
> Hi, > > Thanks for the reply. Though after I wrote my mail I switched my brain > on and realized that we don't actually store anything from journal. We > only use forwarding to socket, and then I guess the imjournal approach > doesn't work. > > I don't know specifically what the journal currently does in this regard, but I think it still stores and writes its files into tmpfs or something along these lines. So imjournal should be able to pick up data from there. However, I do not know how well this does work in regard to repeatedly reading messages vs. not getting hold of content. I guess this requires some testing. Rainer > It seems like the kernel guys aren't keen on making the max_dgram_qlen a > per socket setting so the problem still exists. > > We are thinking of solutions like a "pre" and "post" condition to when > creating the socket. Doing a sysctl set increasing the limit before the > forwarding socket is created, then create the socket and afterwards > reset the limit to default. However there is still a risk (with systemd) > that other sockets are created in parallell during that timeframe so its > still an open question. > > Br, > Jonny > > On Tue, Jul 09, 2013 at 05:20:39PM +0200, David Lang wrote: > > I would suggest that you use imjournal instead. That interface works by > allowing > > the journal to write it's files and then rsyslog uses the journal > interface to > > query for new logs. > > > > Make sure you are running the latest version (both systemd and rsyslog) > because > > there is a bug in earlier versions of systemd that result in a endless > loop when > > reading the journal files. > > > > David Lang > > > > On Fri, 5 Jul 2013, Jonny T?rnbom wrote: > > > > > Hi, > > > > > > We're currently using systemd in our embedded environment. With that we > > > are also using rsyslog, which fetches messages through the forwarding > > > socket provided by journald. > > > > > > The problem we run into is that the time in between journal.socket is > > > created and rsyslog.service is started is so long that the socket gets > > > full. > > > > > > Now when looking at the default configuration in systemd, it's set to > > > 8MB, however the /proc/sys/net/unix/max_dgram_qlen is default > defaulting > > > to 10. This means that only 10 (actually 11) messages will be queued up > > > in the socket and everything after that will be lost up until something > > > starts reading from the socket == rsyslog starts. > > > > > > Now of course this mostly affects bootup, but I'd like to hear your > > > ideas and thoughts around it. Of course one could change the > > > max_dgram_qlen size, but thats a global setting, and starting rsyslog > as > > > early as possible after journal.socket isn't necessarily enough if > > > anything in between is pumping out more than 11 messages. > > > > > > Any ideas/thougts? (I've just now quickly read about imjournal, perhaps > > > it might be a solution?) > > > > > > Br, > > > Jonny > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if > you DON'T LIKE THAT. > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
