Re: More systemdCrap

On 2025-03-13 08:47, Richard Kettlewell wrote:

The Natural Philosopher <tnp@invalid.invalid> writes:

I have an errant service spewing out pages of errors.
>
It appears that journalctl is not able to clear a single service from
its log files.
Anyone know different?

 Pass.
 An approach that might suit you better:
* Send all the logs to syslog.
* Read/filter/delete the syslog files in the traditional way, instead of
   using journalctl.
* Optionally, set the journal size to something small since you won’t be
   using it much.
 This used to be a standard configuration in Debian but I think they’ve
changed the default now.
 There’s two ways to do it:
1) Have journald forward to syslog.
2) Have syslog read from the journal.
 The paragraph at the bottom of
https://www.freedesktop.org/software/systemd/man/latest/journald.conf.html
discusses the differences. I think option #2 would usually be the better
choice, since it reduces the chance of missed messages.
 https://www.loggly.com/ultimate-guide/centralizing-with-syslog/
describes how to set up both approaches. “Using imjournal” corresponds
to option #2.

I had both journal and rsyslog working, but I don't know exactly how I did it years ago. I have experimented with what those two links propose.
I have, on /etc/systemd/journald.conf:
#ForwardToSyslog=no
#MaxLevelSyslog=debug
On /etc/rsyslog.conf I had:
# provides support for local system logging (e.g. via logger command)
$ModLoad imuxsock.so
I commented that line and added:
$ModLoad imjournal
When I restart the syslog daemon, I get a flush of new entries that it reads from the journal. This is not good. And, when I issue:
logger -p local3.info hello
The message gets to the journal but not to the syslog. So I change to
$ModLoad imuxsock.so
$ModLoad imjournal
and now the messages go to both places, but the restart of the daemon adds the flurry of entries to the log files again. This is not clean; when I do changes to the syslog filtering, I have to restart the daemon and everything will be written again.
The weird thing is that with the previous configuration I was getting the messages, except some boot messages.
Oh, I forgot to add
$ModLoad mmjsonparse
No difference, though. So I'm going to try the socket method instead.
/etc/systemd/journald.conf:
ForwardToSyslog=yes
MaxLevelSyslog=debug
/etc/rsyslog.conf:
$ModLoad imuxsock.so
#$ModLoad imjournal
#$ModLoad mmjsonparse
I restart both services, I send a message with logger... everything seems correct.
--
Cheers, Carlos.