Goffredo Baroncelli posted on Fri, 28 Apr 2017 19:05:21 +0200 as excerpted:
> After some thinking I adopted a different strategies: I used journald as > collector, then I forward all the log to rsyslogd, which used a "log > append" format. Journald never write on the root filesystem, only in > tmp. Great minds think alike. =:^) Only here it's syslog-ng that does the permanent writes. I just couldn't see journald's crazy (for btrfs) write pattern going to permanent storage. And AFAIK, journald has no pre-write filtering mechanism at all, only post-write display-time filtering, so even "log-spam" that I don't want/ need logged gets written to it, while if I see something spamming continuously (I run git kernels and kde, and do get such spammers occasionally) I setup a syslog-ng spam filter to kill it, so it never actually gets written to permanent storage at all. But the tmpfs journals and btrfs traditional logs gives me the best of both worlds, per-boot journals with all the extra metadata, the last ten journal entries for it when I do systemctl status on a unit, etc, and a nice filtered and ordered multi-boot log that I can use traditional text- based log-administration tools on. The only part of it I'm not happy with is that journald apparently can't keep separate user and system journals when set to temporary only -- everything goes to the system journal. Which eventually means that much of the stdout/stderr debugging spew that kde-based apps like to spew out ends up in the system journal and (would be in the) log. But that's a journald "documented bug-feature", and I can and do syslog-ng filter it before it actually hits the written system log (or console log display). -- Duncan - List replies preferred. No HTML msgs. "Every nonfree program has a lord, a master -- and if you use the program, he is your master." Richard Stallman -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
