Re: More systemdCrap

The Natural Philosopher <tnp@invalid.invalid> writes:

I have an errant service spewing out pages of errors.
>
It appears that journalctl is not able to clear a single service from
its log files.
Anyone know different?

Pass.

An approach that might suit you better:
* Send all the logs to syslog.
* Read/filter/delete the syslog files in the traditional way, instead of
  using journalctl.
* Optionally, set the journal size to something small since you won’t be
  using it much.

This used to be a standard configuration in Debian but I think they’ve
changed the default now.

There’s two ways to do it:
1) Have journald forward to syslog.
2) Have syslog read from the journal.

The paragraph at the bottom of
https://www.freedesktop.org/software/systemd/man/latest/journald.conf.html
discusses the differences. I think option #2 would usually be the better
choice, since it reduces the chance of missed messages.

https://www.loggly.com/ultimate-guide/centralizing-with-syslog/
describes how to set up both approaches. “Using imjournal” corresponds
to option #2.

--
https://www.greenend.org.uk/rjk/