On 2/25/25 6:57 AM, Mantas Mikulėnas wrote: Hello, thanks for your answer.
These seem like rsyslogd has picked them up directly from the kernel (from the legacy /proc/kmsg guessing from the format) and not from the journal. Systemd-journald loads kernel logs via /dev/kmsg which wouldn't have the [time.stamp] prefix.
hmmm not sure how it's supposed to work. I assume both refer to the same ring buffer. Would a reader consume what it reads which would then not be in the buffer anymore for the second reader to read ? If so wouldn't that be journald first ? On the contrary, if both reads the same content, I should see kernel msg twice on my aggregator
I believe it just logs to /run/log
But this seems to go against the fact that intitalramfs journald can show intitialramfs systemd units (which dracut services are) logs, no ?
I must dig deeper to figure out how it works. Thanks for your help -- Thomas HUMMEL HPC Group Institut PASTEUR Paris, FRANCE
