While studying a bit how journal works, I noticed something odd: My understanding of the boot_id field in the file header is that it should reflect the boot_id of the tail entry, to allow correct interpretation of the tail_entry_monotonic timestamp. This also agrees with the checks done by journal_file_verify(). However, in journal_file_refresh_header(), the boot_id field is updated to the current boot id even though no entry is being added there. This is even being done before the journal file is set online! Shouldn't the header boot_id instead be refreshed in journal_file_link_entry(), where the tail_entry timestamps are being updated? (also, the tail_entry_monotonic_valid flag of JournalFile doesn't seem to get tested anywhere?) Matthijs -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://lists.freedesktop.org/archives/systemd-devel/attachments/20180315/33e532d3/attachment.html>