Matthias Urlichs <matthias@urlichs.de> writes: > Hi, > > Raphaël Halimi: >> raph@arche:~$ journalctl | grep Forwarding > > try this instead: > > $ journalctl _SYSTEMD_UNIT=systemd-journald.service > > which will (most likely) also show messages like "Suppressed 1927 messages > from /PATH/FOO.slice". You can then use > > $ journalctl _SYSTEMD_SLICE=FOO.slice > > to display the non-suppressed part of the spew that's responsible > for this overrun. > >> nov. 10 20:14:34 arche systemd-journal[207]: Forwarding to syslog missed >> 42 messages. > > Presumably, systemd is not capable of changing the speed of your syslog > daemon. So what would happen otherwise? If it's stdout/err logging, the > information would not have been logged at all (daemons redirect it to > /dev/null when backgrounding), or it'd have been tossed when sendmsg() > returns an error due to a full buffer. Or, if it's an intermittent problem > with syslog rather than message spew, the fact that you now have one pipe > to syslogd instead of N of them, each 4k big may be relevant. > > Thus, the fix is > (a) increase the kernel buffer size of the pipe to syslog, > (b) increase the speed of your syslogd, (c) decrease that daemon's latency, > (d) teach whatever program logged so much to Not Do That, and/or > (e) decrease journald's RateLimitBurst= config variable so that > it doesn't overload your syslog. Oh yes, > (f) if your syslog still sync()s a log file after every message, tell it > to not Do That. > > (a) should be a straightforward patch. (b) to (d) are not systemd's > problem. (e) defaults to 1000 in 30 seconds, which may be too much > for your syslog to keep up with. How thoroughly refreshing to see some well reasoned sense talked about systemd for a change. I'm a total newbie to systemd. I've had it on my laptop for a few weeks, and just installed it on an old laptop for a friend. My brief exposure to journalctl (while diagnosing a hardware fault on the second machine) pretty much instantly convinced me that it's a much better way of doing things than having to rummage through a heap of text files, some compressed, rotated on varying schedules etc, where you're always left with the sneaking suspicion that the bit of data you need to see is hiding in some other file that you've forgotten about, or has for some reason simply never made it to a file. If journald manages to do what it's designed to do then future Linux sysadmins won't have to clog their brains up with this drivel. I look forward to forgetting it, as I'm very happy to have forgotten the contents of the sendmail book. It's annoying to realise that we've all been putting up with this slightly shoddy solution to the problem simply because it wasn't quite painful enough to motivate anyone to fix it -- until now. Of course, I've also come across things that I don't like about our systemd setup, which may turn into a bug report once I have time to confirm that I didn't simply screw up the install somehow -- of course this subject has now become so sensitive on all sides that some people will probably assume that I'm reporting such a bug because I hate systemd, so I'll have to be really careful about the wording -- how depressing this mess is. Thanks again for providing a brief moment of sanity. Let the chaos resume :-/ Cheers, Phil. -- |)| Philip Hands [+44 (0)20 8530 9560] HANDS.COM Ltd. |-| http://www.hands.com/ http://ftp.uk.debian.org/ |(| Hugo-Klemm-Strasse 34, 21075 Hamburg, GERMANY
Attachment:
pgpXpdRpJt6PD.pgp
Description: PGP signature