On Mon, Feb 24, 2025 at 10:25 PM Thomas HUMMEL <thomas.hummel@xxxxxxxxxx> wrote:
Hello,
I'm running systemd-239-74 on RHEL 8.8. EUS.
I'm using dracut initialramfs running systemd to PXE boot stateless
compute nodes.
In real-root image, journald is set up to forward to syslog
(ForwardToSyslog=yes) which is handled by rsyslogd to aggregate on a log
server logs from nodes.
So I can see in those logs kernel booting messages (starting with
kernel: [ 0.000000] Linux version 4.18.0-477.43.1.el8_8.x86_64
(mockbuild@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx) (gcc version 8.5.0
20210514 (Red Hat 8.5.0-18) (GCC)) #1 SMP Thu Jan 4 10:30:57 EST 2024
These seem like rsyslogd has picked them up directly from the kernel (from the legacy /proc/kmsg guessing from the format) and not from the journal. Systemd-journald loads kernel logs via /dev/kmsg which wouldn't have the [time.stamp] prefix.
I also sometimes used dracut debug mode and initialramfs journald as
stated in the man:
" rd.debug
set -x for the dracut shell. If systemd is active in the
initramfs, all output is logged to the systemd journal, which
you can inspect with "journalctl -ab". "
I was wondering :
1. is initialramfs journald able to somehow handle its logs to actual
root systemd and if so how ? (my understanding was that, for instance,
such a mechanism was a reason to use dracut NetworkManager (as opposed
to legacy module) module if/when using NetworkManger in actual root)
I believe it just logs to /run/log and the initramfs needs to carry over the same /run tmpfs mount to the "real root" phase, where "flush to /var" picks up both initramfs logs and early rootfs logs at the same time. At least that's how it seems to work with Arch's systemd-based mkinitcpio initramfs.
2. would then initialramfs output also be forwarded to syslog ? Only in
debug mode ?
ForwardToSyslog is not retroactive. You'd need to use the pull method (rsyslogd's imjournal module) to have it forward old messages.
Mantas Mikulėnas
