On Mon, Feb 24, 2025 at 10:25 PM Thomas HUMMEL <thomas.hum...@pasteur.fr> wrote:
> Hello, > > I'm running systemd-239-74 on RHEL 8.8. EUS. > I'm using dracut initialramfs running systemd to PXE boot stateless > compute nodes. > > In real-root image, journald is set up to forward to syslog > (ForwardToSyslog=yes) which is handled by rsyslogd to aggregate on a log > server logs from nodes. > > So I can see in those logs kernel booting messages (starting with > > kernel: [ 0.000000] Linux version 4.18.0-477.43.1.el8_8.x86_64 > (mockbu...@x86-vm-07.build.eng.bos.redhat.com) (gcc version 8.5.0 > 20210514 (Red Hat 8.5.0-18) (GCC)) #1 SMP Thu Jan 4 10:30:57 EST 2024 > These seem like rsyslogd has picked them up directly from the kernel (from the legacy /proc/kmsg guessing from the format) and not from the journal. Systemd-journald loads kernel logs via /dev/kmsg which wouldn't have the [time.stamp] prefix. > I also sometimes used dracut debug mode and initialramfs journald as > stated in the man: > > " rd.debug > set -x for the dracut shell. If systemd is active in the > initramfs, all output is logged to the systemd journal, which > you can inspect with "journalctl -ab". " > > I was wondering : > > 1. is initialramfs journald able to somehow handle its logs to actual > root systemd and if so how ? (my understanding was that, for instance, > such a mechanism was a reason to use dracut NetworkManager (as opposed > to legacy module) module if/when using NetworkManger in actual root) > I believe it just logs to /run/log and the initramfs needs to carry over the same /run tmpfs mount to the "real root" phase, where "flush to /var" picks up both initramfs logs and early rootfs logs at the same time. At least that's how it seems to work with Arch's systemd-based mkinitcpio initramfs. > > 2. would then initialramfs output also be forwarded to syslog ? Only in > debug mode ? > ForwardToSyslog is not retroactive. You'd need to use the pull method (rsyslogd's imjournal module) to have it forward old messages. -- Mantas Mikulėnas
