Path: ...!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: "Carlos E.R." <robin_listas@es.invalid>
Newsgroups: comp.os.linux.misc
Subject: Re: More systemdCrap
Date: Thu, 13 Mar 2025 09:37:10 +0100
Lines: 95
Message-ID: <m2iaalx7l9.ln2@Telcontar.valinor>
References: <vqn41l$1efis$1@dont-email.me>
 <wwvjz8tqsms.fsf@LkoBDZeT.terraraq.uk>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Trace: individual.net FHojhwGeDt4j8o/0TWRJfAY5zwkgnjOaLHmJzbk/7s32//B3o8
X-Orig-Path: Telcontar.valinor!not-for-mail
Cancel-Lock: sha1:aw7+lnWBsA9WTzrvTifYQQV8J1w= sha256:hQip0YwPlU5Bc0UAICox0ZzI4rJxm8nOFNmbjnFsOXU=
User-Agent: Mozilla Thunderbird
Content-Language: es-ES, en-CA
In-Reply-To: <wwvjz8tqsms.fsf@LkoBDZeT.terraraq.uk>
Bytes: 3561

On 2025-03-13 08:47, Richard Kettlewell wrote:
> The Natural Philosopher <tnp@invalid.invalid> writes:
>> I have an errant service spewing out pages of errors.
>>
>> It appears that journalctl is not able to clear a single service from
>> its log files.
>> Anyone know different?
> 
> Pass.
> 
> An approach that might suit you better:
> * Send all the logs to syslog.
> * Read/filter/delete the syslog files in the traditional way, instead of
>    using journalctl.
> * Optionally, set the journal size to something small since you won’t be
>    using it much.
> 
> This used to be a standard configuration in Debian but I think they’ve
> changed the default now.
> 
> There’s two ways to do it:
> 1) Have journald forward to syslog.
> 2) Have syslog read from the journal.
> 
> The paragraph at the bottom of
> https://www.freedesktop.org/software/systemd/man/latest/journald.conf.html
> discusses the differences. I think option #2 would usually be the better
> choice, since it reduces the chance of missed messages.
> 
> https://www.loggly.com/ultimate-guide/centralizing-with-syslog/
> describes how to set up both approaches. “Using imjournal” corresponds
> to option #2.

I had both journal and rsyslog working, but I don't know exactly how I 
did it years ago. I have experimented with what those two links propose.

I have, on /etc/systemd/journald.conf:

#ForwardToSyslog=no
#MaxLevelSyslog=debug

On /etc/rsyslog.conf I had:

# provides support for local system logging (e.g. via logger command)
$ModLoad imuxsock.so

I commented that line and added:

$ModLoad imjournal


When I restart the syslog daemon, I get a flush of new entries that it 
reads from the journal. This is not good. And, when I issue:

logger -p local3.info hello

The message gets to the journal but not to the syslog. So I change to

$ModLoad imuxsock.so
$ModLoad imjournal

and now the messages go to both places, but the restart of the daemon 
adds the flurry of entries to the log files again. This is not clean; 
when I do changes to the syslog filtering, I have to restart the daemon 
and everything will be written again.

The weird thing is that with the previous configuration I was getting 
the messages, except some boot messages.


Oh, I forgot to add

$ModLoad mmjsonparse

No difference, though. So I'm going to try the socket method instead.


/etc/systemd/journald.conf:

ForwardToSyslog=yes
MaxLevelSyslog=debug

/etc/rsyslog.conf:

$ModLoad imuxsock.so
#$ModLoad imjournal
#$ModLoad mmjsonparse


I restart both services, I send a message with logger... everything 
seems correct.


-- 
Cheers, Carlos.