Re: Are logs at /run/log/journal automerged?

[Lennart Poettering <lennart@xxxxxxxxxxxxxx>]

On Mo, 22.08.22 13:02, Yuri Kanivetsky (yuri.kanivetsky@xxxxxxxxx) wrote:

> Hi,
>
> I'm experiencing this on Digital Ocean. The machine id there changes
> (which I think shouldn't happen) on the first boot (supposedly by
> cloud-init).

The machine ID may change during the initrd to host-fs
transition. Otherwise that's not OK though.

When the logs from /run/ are flushed to /var/ they are all merged
together into one.

By default journalctl will show logs associated with the current
machine ID and those associated with the current boot ID. The latter
should usually ensure that logs from the initrd phase are shown as
well if it has a different machine ID.

> In Ubuntu 22.04 droplets, where logs are stored at
> /var/log/journal, that leads to journalctl outputting no records
> (because the log for the new machine-id has not been created), unless
> I pass --file or --merge. Also, the records continue to be added to
> the old log (for the old machine id).
>
> In CentOS 9 droplets, where logs are stored at /run/log/journal,
> journalctl outputs records from all 3 files:
>
> cb754b7b85bb42d1af6b48e7ca843674/system.journal
> 61238251e3db916639eaa8cd54998712/system@6600bdad291b419c8a0b1fea2564c472-0000000000000001-0005e6d123825866.journal
> 61238251e3db916639eaa8cd54998712/system.journal
>
> In this case records also are being added to the old log. But the new
> log somehow contains the beginning of the log (starting with boot).
>
> Is my guess correct? Logs at /run/log/journal are automerged, logs at
> /var/run/journal aren't.

As mentioned abive, when the logs are flushed from /run/ to /var/ in
systemd-journal-flush.service they are merged into one new journal
file, which is located in the machine ID subdir of the actual machine
ID of the system.

Lennart

--
Lennart Poettering, Berlin