Recently I came across an observation where we are not able to capture normal reboot/shutdown logs on Fedora/RHEL distributions. In these environments, systemd is responsible for starting the rsyslog service. A service can have multiple dependencies, which influence how early or how late rsyslog is started or stopped. Many years ago, we added dependency for the network.target and network-online.target into the service file [1]. If rsyslog started before establishing network access, it would be unable to transmit messages to remote destinations during that period, resulting in the generation of misleading information about the unavailability of certain remote targets (e.g. not able to resolve hostnames). However, this approach results in a significant tradeoff. While it prevents misleading unavailability messages during network setup and shutdown, it also causes rsyslog to *exit* *early* during shutdown, leading to missed logs regarding the graceful termination of other programs. This limitation extends to system reboots as well. Thus, while addressing one issue, the current service configuration introduces another. By default, we retrieve shutdown events from the journal using the imjournal module. Journal log data is stored in memory so after shutdown, logs are not preserved.
Has someone faced this problem? Are there any known workarounds? [1] https://github.com/deoren/rsyslog-examples/blob/master/etc/systemd/system/rsyslog.service.d/10-wait-on-network.conf _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
