Make systemd journal persistent | remove rsyslog (by default)

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
15 messages Options
Reply | Threaded
Open this post in threaded view
|

Make systemd journal persistent | remove rsyslog (by default)

Bryan Quigley-2
Hi,

In debugging a shutdown issue I came across a bug [1] that indicates
for us to get better logs [2] during shutdown we really need to make
the systemd journal persistent.   We would also need to remove rsyslog
by default so we don't have duplicate writing of logs to disk.

Aside from shutdown logs we also get a lot of other nice metadata.
For instance, you can ask for all the logs since a certain date.  You
can trivially view the logs from 2 boots ago.

The negative is it is in a binary format and you have to use
journalctl to read it.

I'm sure I missed some positives/negatives.   Thoughts on doing this for Zesty?

To try it out:
sudo mkdir /var/log/journal
reboot twice and now you can view old boots (journalctl --list-boots)
(then optionally) apt-get remove rsyslog

Kind regards,
Bryan

[1] https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1618188
[2] http://pastebin.ubuntu.com/23776783/

--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel
Reply | Threaded
Open this post in threaded view
|

Re: Make systemd journal persistent | remove rsyslog (by default)

Jamie Strandboge-3
On Tue, 2017-01-10 at 17:04 -0500, Bryan Quigley wrote:

> Hi,
>
> In debugging a shutdown issue I came across a bug [1] that indicates
> for us to get better logs [2] during shutdown we really need to make
> the systemd journal persistent.   We would also need to remove rsyslog
> by default so we don't have duplicate writing of logs to disk.
>
> Aside from shutdown logs we also get a lot of other nice metadata.
> For instance, you can ask for all the logs since a certain date.  You
> can trivially view the logs from 2 boots ago.
>
> The negative is it is in a binary format and you have to use
> journalctl to read it.
>
> I'm sure I missed some positives/negatives.
Remote logging. Rsyslog is far superior in this regard. Granted, remote logging
is not enabled by default but it is a requirement in many environments.

--
Jamie Strandboge             | http://www.canonical.com


--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel

signature.asc (836 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Make systemd journal persistent | remove rsyslog (by default)

Jeremy Bicha
In reply to this post by Bryan Quigley-2
On 10 January 2017 at 17:04, Bryan Quigley <[hidden email]> wrote:
> I'm sure I missed some positives/negatives.   Thoughts on doing this for Zesty?

We would need to install gnome-logs instead of gnome-system-log on
Ubuntu Desktop.

And probably have gnome-system-log removed on upgrade. Those who
manually enabled syslog could then install gnome-system-log after if
they want.

Thanks,
Jeremy Bicha

--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel
Reply | Threaded
Open this post in threaded view
|

Re: Make systemd journal persistent | remove rsyslog (by default)

Martin Pitt-4
In reply to this post by Jamie Strandboge-3
Jamie Strandboge [2017-01-10 16:27 -0600]:
> Remote logging. Rsyslog is far superior in this regard. Granted, remote logging
> is not enabled by default but it is a requirement in many environments.

The systemd-journal-remote package does provide the necessary tools and is
reasonably flexible (push or pull, builtin https or using arbitrary ports which
you e. g.  could forward through ssh). It might not be as flexible as rsyslog,
but as one needs to set up remote logging manually anyway, you always have the
possibility of picking rsyslog, journal, or even something else.

Martin
--
Martin Pitt                        | http://www.piware.de
Ubuntu Developer (www.ubuntu.com)  | Debian Developer  (www.debian.org)

--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel

signature.asc (836 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Make systemd journal persistent | remove rsyslog (by default)

Fiedler Roman
In reply to this post by Bryan Quigley-2
> From: [hidden email] [mailto:ubuntu-devel-

>
> Jamie Strandboge [2017-01-10 16:27 -0600]:
> > Remote logging. Rsyslog is far superior in this regard. Granted,
> remote logging
> > is not enabled by default but it is a requirement in many
> environments.
>
> The systemd-journal-remote package does provide the necessary tools and is
> reasonably flexible (push or pull, builtin https or using arbitrary ports
> which
> you e. g.  could forward through ssh). It might not be as flexible as
> rsyslog, but as one needs to set up remote logging manually anyway, you
> always
> have the possibility of picking rsyslog, journal, or even something else.
I have done a POC with systemd-journal-remote yet, but that sounds quite good.
In our production environment following features should be supported also by
Rsyslog replacements to support current usecases and ease gradual rollout:

1) rsyslog RELP mode (reliable remote transport) - reduces probability for
lost messages during network maintenance, e.g. statefull firewall restarts
without conntrack failover.

2) Remote log data caching on network downtimes - data should be transmitted
when network up again

3) Cascading operation: branch offices or guest perform remote logging to a
nearby concentrator, only the concentrator has to be granted off-site access
in firewall

4) TLS support with own CA - each new machine will get a new certificate from
deployment system, central logging should accept traffic from all those
machines with valid certificate automatically (eases automatic rollout)

5) rsyslog/system hybrids: in early phase there will be e.g. some old rsyslog
based LXC containers forwarding logs to systemd-only hosts and perhaps also
vice versa.

6) Streams > 10GB logs/day should not cause any troubles, log data losses.

7) Integration with SIEMs or logmanagement solutions, e.g. graylog.

Perhaps not all those features are possible/sensible to have
systemd-journal-remote. In that case another requirement could arise:

8) Allow local rsyslog/systemd-journal-remote combination: systemd forwards
the logs to a local rsyslog (which might also process other remote data from
requirement 3), and all the really remote forwarding will happen using
old-style rsyslog. Of course this would require maintenance of automation
scripts for setup/automatic configuration of both rsyslog/systemd in various
flavours (host/LXC-guest, Trusty/Xenial/CentOS)


I put it on my list, that I have to do a ~3 machine POC with
systemd-journal-remote only setup to check all those requirements. As rsyslog
is not completely trouble-free, this might help cut down costs in the long
run.

Roman

--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel

smime.p7s (8K) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Make systemd journal persistent | remove rsyslog (by default)

Oliver Grawert
In reply to this post by Martin Pitt-4
hi,
Am Mittwoch, den 11.01.2017, 08:29 +0100 schrieb Martin Pitt:

> Jamie Strandboge [2017-01-10 16:27 -0600]:
> >
> > Remote logging. Rsyslog is far superior in this regard. Granted,
> > remote logging
> > is not enabled by default but it is a requirement in many
> > environments.
> The systemd-journal-remote package does provide the necessary tools
> and is
> reasonably flexible (push or pull, builtin https or using arbitrary
> ports which
> you e. g.  could forward through ssh). 
well, will it blend in in an existing remote rsyslog logging
environment in a datacenter ? i guess having an existing central
rsyslog server that you want to hook in to with a newly set up machine
is a typical usecase.

ciao
        oli
--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel

signature.asc (188 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Make systemd journal persistent | remove rsyslog (by default)

Jamie Strandboge-3
In reply to this post by Martin Pitt-4
On Wed, 2017-01-11 at 08:29 +0100, Martin Pitt wrote:

> Jamie Strandboge [2017-01-10 16:27 -0600]:
> >
> > Remote logging. Rsyslog is far superior in this regard. Granted, remote
> > logging
> > is not enabled by default but it is a requirement in many environments.
> The systemd-journal-remote package does provide the necessary tools and is
> reasonably flexible (push or pull, builtin https or using arbitrary ports
> which
> you e. g.  could forward through ssh). It might not be as flexible as rsyslog,
> but as one needs to set up remote logging manually anyway, you always have the
> possibility of picking rsyslog, journal, or even something else.
>
Yes, but the 'logged to' system needs to be running systemd[1]. rsyslog speaks
the standard syslog protocol on 514/udp, but systemd-journal does not.

[1]https://www.freedesktop.org/software/systemd/man/systemd-journal-remote.html

--
Jamie Strandboge             | http://www.canonical.com


--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel

signature.asc (836 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Make systemd journal persistent | remove rsyslog (by default)

Bryan Quigley-2
We could explicitly keep rsyslog supported in main for at least 18.04
for the for those who need it (or indefinitely if we find it's still
needed for remote enterprise logging).   I was thinking that we might
have to keep it in main until 18.04 anyway for upgrades.

Kind regards,
Bryan


On Wed, Jan 11, 2017 at 5:32 PM, Jamie Strandboge <[hidden email]> wrote:

> On Wed, 2017-01-11 at 08:29 +0100, Martin Pitt wrote:
>> Jamie Strandboge [2017-01-10 16:27 -0600]:
>> >
>> > Remote logging. Rsyslog is far superior in this regard. Granted, remote
>> > logging
>> > is not enabled by default but it is a requirement in many environments.
>> The systemd-journal-remote package does provide the necessary tools and is
>> reasonably flexible (push or pull, builtin https or using arbitrary ports
>> which
>> you e. g.  could forward through ssh). It might not be as flexible as rsyslog,
>> but as one needs to set up remote logging manually anyway, you always have the
>> possibility of picking rsyslog, journal, or even something else.
>>
> Yes, but the 'logged to' system needs to be running systemd[1]. rsyslog speaks
> the standard syslog protocol on 514/udp, but systemd-journal does not.
>
> [1]https://www.freedesktop.org/software/systemd/man/systemd-journal-remote.html
>
> --
> Jamie Strandboge             | http://www.canonical.com
>
>
> --
> ubuntu-devel mailing list
> [hidden email]
> Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel
>

--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel
Reply | Threaded
Open this post in threaded view
|

Re: Make systemd journal persistent | remove rsyslog (by default)

Bryan Quigley-2
In reply to this post by Jeremy Bicha
On Tue, Jan 10, 2017 at 7:07 PM, Jeremy Bicha <[hidden email]> wrote:
> On 10 January 2017 at 17:04, Bryan Quigley <[hidden email]> wrote:
>> I'm sure I missed some positives/negatives.   Thoughts on doing this for Zesty?
>
> We would need to install gnome-logs instead of gnome-system-log on
> Ubuntu Desktop.

Indeed.  Nice catch.

> And probably have gnome-system-log removed on upgrade. Those who
> manually enabled syslog could then install gnome-system-log after if
> they want.

I believe that if we drop gnome-system-log from main (and having
nothing depend on it), do-release-upgrade will give users the options
to remove it.

--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel
Reply | Threaded
Open this post in threaded view
|

Re: Make systemd journal persistent | remove rsyslog (by default)

Jamie Strandboge-3
In reply to this post by Bryan Quigley-2
On Thu, 2017-01-12 at 10:50 -0500, Bryan Quigley wrote:
> We could explicitly keep rsyslog supported in main for at least 18.04
> for the for those who need it (or indefinitely if we find it's still
> needed for remote enterprise logging).   I was thinking that we might
> have to keep it in main until 18.04 anyway for upgrades.
>
I think this would be a hard requirement if it was decided on the switch.

Another thing that came to mind is 'logcheck' (in main) for log auditing and I
don't think it understands systemd-journald log format. logcheck is not
installed by default of course, but it is another package useful in enterprise
environments. If the standard logs are removed, then installing logcheck won't
work by default and additional steps need to be performed to install rsyslog
(and make sure systemd-journald forwards to it).

There are two things here:
1. make systemd journal persistent
2. avoid duplicate logs from rsyslog

Why not just do '1' and let rsyslog remain? The standard logs are rotated so
this shouldn't be overly burdensome. Have you measured how much the duplicate
logs would take on a typical system?

> Kind regards,
> Bryan
>
>
> On Wed, Jan 11, 2017 at 5:32 PM, Jamie Strandboge <[hidden email]> wrote:
> >
> > On Wed, 2017-01-11 at 08:29 +0100, Martin Pitt wrote:
> > >
> > > Jamie Strandboge [2017-01-10 16:27 -0600]:
> > > >
> > > >
> > > > Remote logging. Rsyslog is far superior in this regard. Granted, remote
> > > > logging
> > > > is not enabled by default but it is a requirement in many environments.
> > > The systemd-journal-remote package does provide the necessary tools and is
> > > reasonably flexible (push or pull, builtin https or using arbitrary ports
> > > which
> > > you e. g.  could forward through ssh). It might not be as flexible as
> > > rsyslog,
> > > but as one needs to set up remote logging manually anyway, you always have
> > > the
> > > possibility of picking rsyslog, journal, or even something else.
> > >
> > Yes, but the 'logged to' system needs to be running systemd[1]. rsyslog
> > speaks
> > the standard syslog protocol on 514/udp, but systemd-journal does not.
> >
> > [1]https://www.freedesktop.org/software/systemd/man/systemd-journal-remote.h
> > tml
> >
> > --
> > Jamie Strandboge             | http://www.canonical.com
> >
> >
> > --
> > ubuntu-devel mailing list
> > [hidden email]
> > Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo
> > /ubuntu-devel
> >
--
Jamie Strandboge             | http://www.canonical.com


--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel

signature.asc (836 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Make systemd journal persistent | remove rsyslog (by default)

Anca Emanuel
or make an option on an realy slow PC, to turn it off. Or automatic. Measure boot time and decide...

On Thu, Jan 12, 2017 at 6:20 PM, Jamie Strandboge <[hidden email]> wrote:
On Thu, 2017-01-12 at 10:50 -0500, Bryan Quigley wrote:
> We could explicitly keep rsyslog supported in main for at least 18.04
> for the for those who need it (or indefinitely if we find it's still
> needed for remote enterprise logging).   I was thinking that we might
> have to keep it in main until 18.04 anyway for upgrades.
>
I think this would be a hard requirement if it was decided on the switch.

Another thing that came to mind is 'logcheck' (in main) for log auditing and I
don't think it understands systemd-journald log format. logcheck is not
installed by default of course, but it is another package useful in enterprise
environments. If the standard logs are removed, then installing logcheck won't
work by default and additional steps need to be performed to install rsyslog
(and make sure systemd-journald forwards to it).

There are two things here:
1. make systemd journal persistent
2. avoid duplicate logs from rsyslog

Why not just do '1' and let rsyslog remain? The standard logs are rotated so
this shouldn't be overly burdensome. Have you measured how much the duplicate
logs would take on a typical system?

> Kind regards,
> Bryan
>
>
> On Wed, Jan 11, 2017 at 5:32 PM, Jamie Strandboge <[hidden email]> wrote:
> >
> > On Wed, 2017-01-11 at 08:29 +0100, Martin Pitt wrote:
> > >
> > > Jamie Strandboge [2017-01-10 16:27 -0600]:
> > > >
> > > >
> > > > Remote logging. Rsyslog is far superior in this regard. Granted, remote
> > > > logging
> > > > is not enabled by default but it is a requirement in many environments.
> > > The systemd-journal-remote package does provide the necessary tools and is
> > > reasonably flexible (push or pull, builtin https or using arbitrary ports
> > > which
> > > you e. g.  could forward through ssh). It might not be as flexible as
> > > rsyslog,
> > > but as one needs to set up remote logging manually anyway, you always have
> > > the
> > > possibility of picking rsyslog, journal, or even something else.
> > >
> > Yes, but the 'logged to' system needs to be running systemd[1]. rsyslog
> > speaks
> > the standard syslog protocol on 514/udp, but systemd-journal does not.
> >
> > [1]https://www.freedesktop.org/software/systemd/man/systemd-journal-remote.h
> > tml
> >
> > --
> > Jamie Strandboge             | http://www.canonical.com
> >
> >
> > --
> > ubuntu-devel mailing list
> > [hidden email]
> > Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo
> > /ubuntu-devel
> >
--
Jamie Strandboge             | http://www.canonical.com


--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel



--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel
Reply | Threaded
Open this post in threaded view
|

AW: Make systemd journal persistent | remove rsyslog (by default)

Fiedler Roman
In reply to this post by Jamie Strandboge-3

> From: [hidden email] [mailto:ubuntu-devel-
> [hidden email]] Im Auftrag von Jamie Strandboge
> Subject: Re: Make systemd journal persistent | remove rsyslog (by
> default)
>
> On Thu, 2017-01-12 at 10:50 -0500, Bryan Quigley wrote:
> > We could explicitly keep rsyslog supported in main for at least 18.04
> > for the for those who need it (or indefinitely if we find it's still
> > needed for remote enterprise logging).   I was thinking that we might
> > have to keep it in main until 18.04 anyway for upgrades.
> >
> I think this would be a hard requirement if it was decided on the
> switch.
>
> Another thing that came to mind is 'logcheck' (in main) for log auditing
> and I
> don't think it understands systemd-journald log format. logcheck is not
> installed by default of course, but it is another package useful in
> enterprise
> environments. If the standard logs are removed, then installing logcheck
> won't
> work by default and additional steps need to be performed to install
> rsyslog
> (and make sure systemd-journald forwards to it).
>
> There are two things here:
> 1. make systemd journal persistent
> 2. avoid duplicate logs from rsyslog
>
> Why not just do '1' and let rsyslog remain? The standard logs are
> rotated so
> this shouldn't be overly burdensome. Have you measured how much the
> duplicate
> logs would take on a typical system?
Why not try building an improved logcheck supporting sockets/streams? We also
used logcheck in our environment, but in one of our projects we experimented
with a more configurable variant, that could overcome typical problems seen
with logcheck, e.g. run also on small devices (logcheck in batch needs large
amount of disk/memory to create large reports), allow more finegrained
whitelisting, custom filters/detectors/analyzers, stream operation, fast
mail/custom alerting (e.g. 10sec after first event with logarithmic backoff),
... We now use it also on some of our internal machines. We also published the
IO and primitive filtering layer open source as "logdata-anomaly-miner".
Currently it is still hell to configure, but perhaps with some effort writing
good "default check configurations", systemd with UNIX socket and stream
logchecking might be interesting. At the moment we use the socket scheme to
connect AMiner to auditd, where the amount of log data to analyze might be too
large to write it to disk or send it to remote filtering machine.

Perhaps our approach is too much on the research/experimentation side, but
logdata-anomaly-miner IO reading/alerting + logcheck regex module might be
easy to build and even give backward compatibility with logcheck/operation on
readonly root disk systems, ...




--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel

smime.p7s (8K) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Make systemd journal persistent | remove rsyslog (by default)

Mark Shuttleworth-2
In reply to this post by Oliver Grawert
On 11/01/17 05:05, Oliver Grawert wrote:

> hi,
> Am Mittwoch, den 11.01.2017, 08:29 +0100 schrieb Martin Pitt:
>> Jamie Strandboge [2017-01-10 16:27 -0600]:
>>> Remote logging. Rsyslog is far superior in this regard. Granted,
>>> remote logging
>>> is not enabled by default but it is a requirement in many
>>> environments.
>> The systemd-journal-remote package does provide the necessary tools
>> and is
>> reasonably flexible (push or pull, builtin https or using arbitrary
>> ports which
>> you e. g.  could forward through ssh).
> well, will it blend in in an existing remote rsyslog logging
> environment in a datacenter ? i guess having an existing central
> rsyslog server that you want to hook in to with a newly set up machine
> is a typical usecase.
Let's optimise for the standalone case, people who administer clusters
can easily apt-get what they need.

Mark


--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel

signature.asc (188 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Make systemd journal persistent | remove rsyslog (by default)

Bryan Quigley-2
In reply to this post by Jamie Strandboge-3
On Thu, Jan 12, 2017 at 11:20 AM, Jamie Strandboge <[hidden email]> wrote:
...
> There are two things here:
> 1. make systemd journal persistent
> 2. avoid duplicate logs from rsyslog
>
> Why not just do '1' and let rsyslog remain? The standard logs are rotated so
> this shouldn't be overly burdensome. Have you measured how much the duplicate
> logs would take on a typical system?

Just doing '1' completely solves my problem and I have not been able
to find any significant performance issues when looking at just boot
time.

That also could lend itself to interim options like logging less to
rsyslog but keeping it for now, which might work around any issues
that come up.

So yes, I'm totally open to just doing '1'.

Kind regards,
Bryan

>> On Wed, Jan 11, 2017 at 5:32 PM, Jamie Strandboge <[hidden email]> wrote:
>> >
>> > On Wed, 2017-01-11 at 08:29 +0100, Martin Pitt wrote:
>> > >
>> > > Jamie Strandboge [2017-01-10 16:27 -0600]:
>> > > >
>> > > >
>> > > > Remote logging. Rsyslog is far superior in this regard. Granted, remote
>> > > > logging
>> > > > is not enabled by default but it is a requirement in many environments.
>> > > The systemd-journal-remote package does provide the necessary tools and is
>> > > reasonably flexible (push or pull, builtin https or using arbitrary ports
>> > > which
>> > > you e. g.  could forward through ssh). It might not be as flexible as
>> > > rsyslog,
>> > > but as one needs to set up remote logging manually anyway, you always have
>> > > the
>> > > possibility of picking rsyslog, journal, or even something else.
>> > >
>> > Yes, but the 'logged to' system needs to be running systemd[1]. rsyslog
>> > speaks
>> > the standard syslog protocol on 514/udp, but systemd-journal does not.
>> >
>> > [1]https://www.freedesktop.org/software/systemd/man/systemd-journal-remote.h
>> > tml
>> >
>> > --
>> > Jamie Strandboge             | http://www.canonical.com
>> >
>> >
>> > --
>> > ubuntu-devel mailing list
>> > [hidden email]
>> > Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo
>> > /ubuntu-devel
>> >
> --
> Jamie Strandboge             | http://www.canonical.com
>

--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel
Reply | Threaded
Open this post in threaded view
|

Re: Make systemd journal persistent | remove rsyslog (by default)

Louis Bouchard-2
Hello,

Le 17/01/2017 à 21:46, Bryan Quigley a écrit :

> On Thu, Jan 12, 2017 at 11:20 AM, Jamie Strandboge <[hidden email]> wrote:
> ...
>> > There are two things here:
>> > 1. make systemd journal persistent
>> > 2. avoid duplicate logs from rsyslog
>> >
>> > Why not just do '1' and let rsyslog remain? The standard logs are rotated so
>> > this shouldn't be overly burdensome. Have you measured how much the duplicate
>> > logs would take on a typical system?
> Just doing '1' completely solves my problem and I have not been able
> to find any significant performance issues when looking at just boot
> time.
>
> That also could lend itself to interim options like logging less to
> rsyslog but keeping it for now, which might work around any issues
> that come up.
>
> So yes, I'm totally open to just doing '1'.
>
> Kind regards,
> Bryan
>

I do agree that having the systemd journal persistent would be a supportability
bonus. I've had to ask customers in the past to enable persistence to verify
that specific issues did happen prior to a reboot.

Kind regards,

...Loui



--
Louis Bouchard
Software engineer, Cloud & Sustaining eng.
Canonical Ltd
Ubuntu developer                       Debian Maintainer
GPG : 429D 7A3B DD05 B6F8 AF63  B9C4 8B3D 867C 823E 7A61

--
ubuntu-devel mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel