On Wed, Sep 16, 2015 at 3:57 PM, Alan McKinnon <[email protected]> wrote: > On 16/09/2015 21:42, Rich Freeman wrote: >> On Wed, Sep 16, 2015 at 12:55 PM, Alan McKinnon <[email protected]> >> wrote: >>> >>> It has something to do with systemd's log thingy. >>> >>> The error only appears in one place in the syslog-ng source, >>> in modules/systemd-journal/journal-reader.c: >>> >>> static inline gboolean >>> __seek_to_saved_state(JournalReader *self) >>> { >>> JournalReaderState *state = >>> persist_state_map_entry(self->persist_state, self->persist_handle); >>> gint rc = journald_seek_cursor(self->journal, state->cursor); >>> persist_state_unmap_entry(self->persist_state, self->persist_handle); >>> if (rc != 0) >>> { >>> msg_warning("Failed to seek to the cursor", >>> evt_tag_str("cursor", state->cursor), >>> evt_tag_errno("error", errno), >>> NULL); >>> return __seek_to_head(self); >>> } >>> journald_next(self->journal); >>> return TRUE; >>> } >>> >> >> The other posts are getting at the solution - disable journal support >> if you're not actually using systemd. >> >> However, does syslog-ng actually READ logs? My understanding is that >> journal cursors are used to read logs, not to write them, and I >> associate syslog-ng more with writing logs. >> >> The concept is that when you query the journal every record gets >> returned with a cursor, which is just a guid of some sort. Then you >> can run a later query and pass the last cursor you saw back and just >> get a list of new records since the last one you read. The use case >> is for log monitors and such so that they can periodically poll the >> log without having to read the entire thing from the beginning each >> time. >> > > > Digging up ancient memory from other people's posts long ago: > > Doesn't syslog-ng read systemd's log from early userspace startup > (before syslog-ng starts) and write those entries to syslog-ng? >
Ah, that makes sense. This isn't about recording syslog data in the journal. This is about recording journal data in syslog, for which using cursors would be a completely obvious design. -- Rich
