On Mon, Jul 15, 2013 at 2:45 PM, Lennart Poettering <mzerqung@xxxxxxxxxxx> wrote: > You'd usually mount your journal files dir, then direct "journalctl -D > /path/to/the/journal/files/dir" to it. It will then collect all files in > that dir, interleave them and present them to you. Thanks! And that -D would be to the dir normally under /var/log/journal AIUI. My reference earlier to /var/lib/systemd/catalog was wrong I believe. =>> - What guarantees of completeness/consistency can we expect in >> practice from the journal in a hard poweroff situation? What is the >> price in terms of fsync() calls? >> > We sync() all journal files to disk 5min after each write the latest that's new and interesting. AIUI pre-journal, the default was to sync() on every message for some logs (and overrriden with a hyphen for some logs). Am I wrong? Heading offtopic: Are there ways to control sync on a per-service basis? Or to trigger a sync on things like authentication failures, OOM shootouts, or kernel oopses? IOWs, logging potentially catastophic event events is always without guarantees, but when it works, it logs damn useful info. (snipped lots of good info, thanks!) > When the journal starts up and finds a journal file is not marked > "offline" it will immediately rotate the file and start a new one, in > order to make sure we never fiddle with files that have incomplete > transactions in them. OK. That's sane and failsafe. > With the default settings, in the worst case you might lose 4:59s of > logs, but even that is very unlikely. The trick with this is... you usually have a short window between the catastrophic event and the problem. Sometimes the problem cripples the system irretrievably. Can't win in that case. But there are plenty of "in the middle" cases where if logs written out in time can help diagnose issues. > Of course, things are different if some other form of corruption takes > place, i.e. where the fs gets corrupted so badly due to some external > condition that the middle of the journal files is bad. We do not provide > any recovery tools for that case currently. It's gonna happen at some point :-) Anyway, if the file-format is append-only and indexes and such are rebuildable, then it's within reach. Still, not a happy prospect for the first admin to need it. cheers, m -- martin.langhoff@xxxxxxxxx - ask interesting questions - don't get distracted with shiny stuff - working code first ~ http://docs.moodle.org/en/User:Martin_Langhoff -- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel