Re: [Mageia-dev] [RFC] rsyslog vs journalctl
On Mon, 11 Feb 2013 20:16:38 -0500, Johnny A. Solbu coo...@solbu.net wrote: On Monday 11. February 2013 23.42, David W. Hodgins wrote: make sure there is a line with 127.0.0.1 beria.inria.fr beria in /etc/hosts, then run dracut -f. Why run dracut? My mistake. I was thinking journalctl was being started during the initrd processing, but looking at the hooks, it only creates the socket, with journalctl not actually starting until after the root pivot. Regards, Dave Hodgins
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
Le 08/02/2013 11:15, Colin Guthrie a écrit : 'Twas brillig, and Guillaume Rousse at 08/02/13 10:06 did gyre and gimble: Le 07/02/2013 19:40, AL13N a écrit : Op donderdag 7 februari 2013 13:34:06 schreef Colin Guthrie: 'Twas brillig, and AL13N at 07/02/13 11:40 did gyre and gimble: [...] what about the tty12 bug? can this be fixed with journald? it seems to be a feature that people don't want to lose? Not sure. I'll find out. It should be trivial really... i.e. all it really needs is a journalctl -f command run on tty12. You could craft an agetty command that worked like that easily enough, although there may be something more elegant that is more efficient and cleaner. since the tty12 feature is present now, it would be nice if it could still be there and started as soon as possible, just like before. I'd like tough than journald be reloaded if the host name change. That's a bit painful to get logs for 'localhost' just because the name was set after starting log system. Restarting journald is not a great idea if you can avoid it. At present it doesn't yet support a full reexec mode which preserves file descriptors which are connected to it thus some apps may lose their logging depending on how they are connected to it. Also I'm not sure what you mean... if I change my hostname, it's reflected properly in the journal. Does this not happen on your system? Perhaps some configuration probme with nss-myhostname (tho' not 100% that matters)? Just the fact than /var/log/message contains lines as: Feb 11 19:51:52 localhost acpid: client connected from 2074[0:0] Feb 11 19:51:52 localhost acpid: 1 client rule loaded etc... Whereas my host name, set from HOSTNAME variable in /etc/sysconfig/network, is beria.inria.fr. I have to restart my syslog daemon to get it correct. So I guess just ensuring the hostname is either set prior the start of the logging process, or refreshing this last one thereafter, would avoid the issue. I was probably wrong in seeing journald as a potential responsable here, tough, as it also happens on a mageia 2 system. -- BOFH excuse #451: astropneumatic oscillations in the water-cooling
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
On Mon, 11 Feb 2013 13:59:46 -0500, Guillaume Rousse guillomovi...@gmail.com wrote: Whereas my host name, set from HOSTNAME variable in /etc/sysconfig/network, is beria.inria.fr. I have to restart my syslog daemon to get it correct. So I guess just ensuring the hostname is either set prior the start of the logging process, or refreshing this last one thereafter, would avoid the issue. In addition to having HOSTNAME=beria.inria.fr in /etc/sysconfig/network put beria.inria.fr (without the quotes or HOSTNAME=) in /etc/hostname, and make sure there is a line with 127.0.0.1 beria.inria.fr beria in /etc/hosts, then run dracut -f. Regards, Dave Hodgins
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
On Monday 11. February 2013 23.42, David W. Hodgins wrote: make sure there is a line with 127.0.0.1 beria.inria.fr beria in /etc/hosts, then run dracut -f. Why run dracut? -- Johnny A. Solbu PGP key ID: 0xFA687324 signature.asc Description: This is a digitally signed message part.
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
'Twas brillig, and eatdirt at 09/02/13 15:18 did gyre and gimble: Are you sure that there still is a problem? There were some bugs that have been fixed months ago. Aside from that the memory usage could be off as journal uses mmap. But systemd always uses the journal (not runtime configurable IIRC), so best to make it efficient. It should also somehow be low maintenance. Meaning: maybe it will use less memory when there is less available (guessing)? I don't know about mmap, but that's what a top gives on the current cooker: 326 root 1 0 1064m 37m 36m S0 1.9 0:14.73 systemd-journal even though it is only virtual, that's sound crazy to go up 1GB. rsyslog never goes above 1M. The virtual size is more or less irrelevant for judging how much memory it actually uses. In some cases it does help identify some leaks (tho' not classic memory leaks - more mmap leaks - found and fixed one of those a while back). It is a little higher than I'd expect all the same tho'. I'll double check that no regressions have snuck in on the mmap window caching stuff. Col -- Colin Guthrie colin(at)mageia.org http://colin.guthr.ie/ Day Job: Tribalogic Limited http://www.tribalogic.net/ Open Source: Mageia Contributor http://www.mageia.org/ PulseAudio Hacker http://www.pulseaudio.org/ Trac Hacker http://trac.edgewall.org/
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
Are you sure that there still is a problem? There were some bugs that have been fixed months ago. Aside from that the memory usage could be off as journal uses mmap. But systemd always uses the journal (not runtime configurable IIRC), so best to make it efficient. It should also somehow be low maintenance. Meaning: maybe it will use less memory when there is less available (guessing)? I don't know about mmap, but that's what a top gives on the current cooker: 326 root 1 0 1064m 37m 36m S0 1.9 0:14.73 systemd-journal even though it is only virtual, that's sound crazy to go up 1GB. rsyslog never goes above 1M. Cheers, Chris.
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
On Sat, Feb 09, 2013 at 04:18:32PM +0100, eatdirt wrote: Are you sure that there still is a problem? There were some bugs that have been fixed months ago. Aside from that the memory usage could be off as journal uses mmap. But systemd always uses the journal (not runtime configurable IIRC), so best to make it efficient. It should also somehow be low maintenance. Meaning: maybe it will use less memory when there is less available (guessing)? I don't know about mmap, but that's what a top gives on the current cooker: 326 root 1 0 1064m 37m 36m S0 1.9 0:14.73 systemd-journal even though it is only virtual, that's sound crazy to go up 1GB. rsyslog never goes above 1M. I already mentioned the usage of mmap. -- Regards, Olav
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
'Twas brillig, and AL13N at 07/02/13 18:40 did gyre and gimble: Op donderdag 7 februari 2013 13:34:06 schreef Colin Guthrie: 'Twas brillig, and AL13N at 07/02/13 11:40 did gyre and gimble: [...] what about the tty12 bug? can this be fixed with journald? it seems to be a feature that people don't want to lose? Not sure. I'll find out. It should be trivial really... i.e. all it really needs is a journalctl -f command run on tty12. You could craft an agetty command that worked like that easily enough, although there may be something more elegant that is more efficient and cleaner. since the tty12 feature is present now, it would be nice if it could still be there and started as soon as possible, just like before. Just to try it, can you set: TTYPath=/dev/tty12 ForwardToConsole=yes in /etc/systemd/journald.conf I'm not 100% sure whether it really should be available by default tho'. I mean, if you are a logged in user you cannot view the system logs unless you are in the adm group or root. Why should you just be able to see it via switching to a tty? Seems somewhat counter intuitive to me. Of course you could say that if someone has physical access then all bets are off anyway... but IMO it does still seem slightly juxtaposed. Thoughts welcome on whether: a) This should be off by default (as now - but change from classic syslog) b) We should default it to on. c) We should provide an easy to use ticky box to turn it off/on easily via GUI. Regardless, we should probably configure all syslogs to not do this by default (as it will class if it's enabled in the journal). Thoughts? Col -- Colin Guthrie colin(at)mageia.org http://colin.guthr.ie/ Day Job: Tribalogic Limited http://www.tribalogic.net/ Open Source: Mageia Contributor http://www.mageia.org/ PulseAudio Hacker http://www.pulseaudio.org/ Trac Hacker http://trac.edgewall.org/
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
'Twas brillig, and AL13N at 07/02/13 18:43 did gyre and gimble: Op donderdag 7 februari 2013 15:10:43 schreef Guillaume Rousse: Le 07/02/2013 14:40, Colin Guthrie a écrit : Is anyone against the name system-logger? If so I'll update things accordingly. Other name suggestions welcome. Fine with me. that's fine. i just mentioned this because iirc lennart at his talk in FOSDEM said that journald didn't do remote syslogging Yup, for remote syslogging you still want a syslog. There are various things you can do with the journal remotely (e.g. you can mount remote journals via NFS to a single machine and then read all the logs in via the -m command to journalctl, or you can use the journal gatewayd to get a nice web interface to the logs on remote machines. There will be further efforts to do networking with the journal, but due to the fact it carries a lot more metadata than plain syslog, it cannot go directly via syslog protocol anyway. But yeah, if you want remote syslog logging, just install rsyslog or similar :) Col -- Colin Guthrie colin(at)mageia.org http://colin.guthr.ie/ Day Job: Tribalogic Limited http://www.tribalogic.net/ Open Source: Mageia Contributor http://www.mageia.org/ PulseAudio Hacker http://www.pulseaudio.org/ Trac Hacker http://trac.edgewall.org/
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
Le 07/02/2013 19:40, AL13N a écrit : Op donderdag 7 februari 2013 13:34:06 schreef Colin Guthrie: 'Twas brillig, and AL13N at 07/02/13 11:40 did gyre and gimble: [...] what about the tty12 bug? can this be fixed with journald? it seems to be a feature that people don't want to lose? Not sure. I'll find out. It should be trivial really... i.e. all it really needs is a journalctl -f command run on tty12. You could craft an agetty command that worked like that easily enough, although there may be something more elegant that is more efficient and cleaner. since the tty12 feature is present now, it would be nice if it could still be there and started as soon as possible, just like before. I'd like tough than journald be reloaded if the host name change. That's a bit painful to get logs for 'localhost' just because the name was set after starting log system. -- BOFH excuse #164: root rot
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
'Twas brillig, and Guillaume Rousse at 08/02/13 10:06 did gyre and gimble: Le 07/02/2013 19:40, AL13N a écrit : Op donderdag 7 februari 2013 13:34:06 schreef Colin Guthrie: 'Twas brillig, and AL13N at 07/02/13 11:40 did gyre and gimble: [...] what about the tty12 bug? can this be fixed with journald? it seems to be a feature that people don't want to lose? Not sure. I'll find out. It should be trivial really... i.e. all it really needs is a journalctl -f command run on tty12. You could craft an agetty command that worked like that easily enough, although there may be something more elegant that is more efficient and cleaner. since the tty12 feature is present now, it would be nice if it could still be there and started as soon as possible, just like before. I'd like tough than journald be reloaded if the host name change. That's a bit painful to get logs for 'localhost' just because the name was set after starting log system. Restarting journald is not a great idea if you can avoid it. At present it doesn't yet support a full reexec mode which preserves file descriptors which are connected to it thus some apps may lose their logging depending on how they are connected to it. Also I'm not sure what you mean... if I change my hostname, it's reflected properly in the journal. Does this not happen on your system? Perhaps some configuration probme with nss-myhostname (tho' not 100% that matters)? Col -- Colin Guthrie colin(at)mageia.org http://colin.guthr.ie/ Day Job: Tribalogic Limited http://www.tribalogic.net/ Open Source: Mageia Contributor http://www.mageia.org/ PulseAudio Hacker http://www.pulseaudio.org/ Trac Hacker http://trac.edgewall.org/
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
On Fri, Feb 8, 2013 at 9:54 AM, Colin Guthrie mag...@colin.guthr.ie wrote: 'Twas brillig, and AL13N at 07/02/13 18:40 did gyre and gimble: Op donderdag 7 februari 2013 13:34:06 schreef Colin Guthrie: 'Twas brillig, and AL13N at 07/02/13 11:40 did gyre and gimble: [...] what about the tty12 bug? can this be fixed with journald? it seems to be a feature that people don't want to lose? Not sure. I'll find out. It should be trivial really... i.e. all it really needs is a journalctl -f command run on tty12. You could craft an agetty command that worked like that easily enough, although there may be something more elegant that is more efficient and cleaner. since the tty12 feature is present now, it would be nice if it could still be there and started as soon as possible, just like before. Just to try it, can you set: TTYPath=/dev/tty12 ForwardToConsole=yes in /etc/systemd/journald.conf I'm not 100% sure whether it really should be available by default tho'. I mean, if you are a logged in user you cannot view the system logs unless you are in the adm group or root. Why should you just be able to see it via switching to a tty? Seems somewhat counter intuitive to me. I think it used to be enabled or not by msec depending on security level Of course you could say that if someone has physical access then all bets are off anyway... but IMO it does still seem slightly juxtaposed. Thoughts welcome on whether: a) This should be off by default (as now - but change from classic syslog) b) We should default it to on. c) We should provide an easy to use ticky box to turn it off/on easily via GUI. Regardless, we should probably configure all syslogs to not do this by default (as it will class if it's enabled in the journal). Thoughts? Col -- Colin Guthrie colin(at)mageia.org http://colin.guthr.ie/ Day Job: Tribalogic Limited http://www.tribalogic.net/ Open Source: Mageia Contributor http://www.mageia.org/ PulseAudio Hacker http://www.pulseaudio.org/ Trac Hacker http://trac.edgewall.org/
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
On Fri, Feb 8, 2013 at 10:31 AM, Pascal Terjan pter...@gmail.com wrote: On Fri, Feb 8, 2013 at 9:54 AM, Colin Guthrie mag...@colin.guthr.ie wrote: 'Twas brillig, and AL13N at 07/02/13 18:40 did gyre and gimble: Op donderdag 7 februari 2013 13:34:06 schreef Colin Guthrie: 'Twas brillig, and AL13N at 07/02/13 11:40 did gyre and gimble: [...] what about the tty12 bug? can this be fixed with journald? it seems to be a feature that people don't want to lose? Not sure. I'll find out. It should be trivial really... i.e. all it really needs is a journalctl -f command run on tty12. You could craft an agetty command that worked like that easily enough, although there may be something more elegant that is more efficient and cleaner. since the tty12 feature is present now, it would be nice if it could still be there and started as soon as possible, just like before. Just to try it, can you set: TTYPath=/dev/tty12 ForwardToConsole=yes in /etc/systemd/journald.conf I'm not 100% sure whether it really should be available by default tho'. I mean, if you are a logged in user you cannot view the system logs unless you are in the adm group or root. Why should you just be able to see it via switching to a tty? Seems somewhat counter intuitive to me. I think it used to be enabled or not by msec depending on security level /usr/share/msec/plugins/msec.py:def enable_console_log(self, arg, expr='*.*', dev='tty12'):
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
'Twas brillig, and Pascal Terjan at 08/02/13 10:33 did gyre and gimble: On Fri, Feb 8, 2013 at 10:31 AM, Pascal Terjan pter...@gmail.com wrote: On Fri, Feb 8, 2013 at 9:54 AM, Colin Guthrie mag...@colin.guthr.ie wrote: 'Twas brillig, and AL13N at 07/02/13 18:40 did gyre and gimble: Op donderdag 7 februari 2013 13:34:06 schreef Colin Guthrie: 'Twas brillig, and AL13N at 07/02/13 11:40 did gyre and gimble: [...] what about the tty12 bug? can this be fixed with journald? it seems to be a feature that people don't want to lose? Not sure. I'll find out. It should be trivial really... i.e. all it really needs is a journalctl -f command run on tty12. You could craft an agetty command that worked like that easily enough, although there may be something more elegant that is more efficient and cleaner. since the tty12 feature is present now, it would be nice if it could still be there and started as soon as possible, just like before. Just to try it, can you set: TTYPath=/dev/tty12 ForwardToConsole=yes in /etc/systemd/journald.conf I'm not 100% sure whether it really should be available by default tho'. I mean, if you are a logged in user you cannot view the system logs unless you are in the adm group or root. Why should you just be able to see it via switching to a tty? Seems somewhat counter intuitive to me. I think it used to be enabled or not by msec depending on security level /usr/share/msec/plugins/msec.py:def enable_console_log(self, arg, expr='*.*', dev='tty12'): A, OK, so perhaps just some tweakage there could do the trick... Col -- Colin Guthrie colin(at)mageia.org http://colin.guthr.ie/ Day Job: Tribalogic Limited http://www.tribalogic.net/ Open Source: Mageia Contributor http://www.mageia.org/ PulseAudio Hacker http://www.pulseaudio.org/ Trac Hacker http://trac.edgewall.org/
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
'Twas brillig, and David Walser at 06/02/13 18:28 did gyre and gimble: Colin Guthrie mageia@... writes: Oh, for the avoidance of doubt, I don't think there is any argument that would suggest the removal from the repositories or obsoletion of rsyslog or syslog-ng etc. I agree, and that's consistent with what you've said in the past. I thought it was odd that the idea of obsoleting them came up yesterday in the packager meeting, but it did. The main reason was wanting to know if rsyslog should still be on the DVD, in case of users using it to upgrade from Mageia 2. It may be the case that not upgrading that particular package during the DVD upgrade won't *break* anything and it can just be upgraded after the system is booted and urpmi sources are added, in which case it doesn't *need* to be on the DVD. Otherwise, we should make sure it's on there. What I guess we could to to avoid putting rsyslog on the physical media would be to put a versioned conflicts in the main systemd package with rsyslog and syslog-ng. Thus the old packages should be removed when upgrading (AIUI). Col -- Colin Guthrie colin(at)mageia.org http://colin.guthr.ie/ Day Job: Tribalogic Limited http://www.tribalogic.net/ Open Source: Mageia Contributor http://www.mageia.org/ PulseAudio Hacker http://www.pulseaudio.org/ Trac Hacker http://trac.edgewall.org/
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
'Twas brillig, and David Walser at 06/02/13 18:28 did gyre and gimble: [...] What I guess we could to to avoid putting rsyslog on the physical media would be to put a versioned conflicts in the main systemd package with rsyslog and syslog-ng. Thus the old packages should be removed when upgrading (AIUI). not a really good idea imho, i have a server which uses rsyslog for network remote syslogging... so upgrading that would break this. what about the tty12 bug? can this be fixed with journald? it seems to be a feature that people don't want to lose?
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
Le 07/02/2013 12:40, AL13N a écrit : 'Twas brillig, and David Walser at 06/02/13 18:28 did gyre and gimble: [...] What I guess we could to to avoid putting rsyslog on the physical media would be to put a versioned conflicts in the main systemd package with rsyslog and syslog-ng. Thus the old packages should be removed when upgrading (AIUI). not a really good idea imho, i have a server which uses rsyslog for network remote syslogging... so upgrading that would break this. Indeed. Just because journal is installed (no choice here) shouldn't prevent to install a real syslog-daemon. I'd rather introduce another virtual package, such as syslog-daemon-minimal (or anything else), and lower the dependencies of basesystem to just require this last one. -- BOFH excuse #341: HTTPD Error 666 : BOFH was here
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
'Twas brillig, and Guillaume Rousse at 07/02/13 12:20 did gyre and gimble: Le 07/02/2013 12:40, AL13N a écrit : 'Twas brillig, and David Walser at 06/02/13 18:28 did gyre and gimble: [...] What I guess we could to to avoid putting rsyslog on the physical media would be to put a versioned conflicts in the main systemd package with rsyslog and syslog-ng. Thus the old packages should be removed when upgrading (AIUI). not a really good idea imho, i have a server which uses rsyslog for network remote syslogging... so upgrading that would break this. Indeed. Just because journal is installed (no choice here) shouldn't prevent to install a real syslog-daemon. I'd rather introduce another virtual package, such as syslog-daemon-minimal (or anything else), and lower the dependencies of basesystem to just require this last one. I'm not really sure what that gains... i.e. that's that's effectively what we have right now with the current provides of syslog-daemon via systemd itself. Arguably the semantics are wrong... e.g. it should really be called system-logger or something more generic. But as things stand you no longer *need* to install rsyslog et al - it's just an option. And as things stand right now, if rsyslog is included in the media it will be upgraded happily and keep on running. Col -- Colin Guthrie colin(at)mageia.org http://colin.guthr.ie/ Day Job: Tribalogic Limited http://www.tribalogic.net/ Open Source: Mageia Contributor http://www.mageia.org/ PulseAudio Hacker http://www.pulseaudio.org/ Trac Hacker http://trac.edgewall.org/
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
'Twas brillig, and AL13N at 07/02/13 11:40 did gyre and gimble: 'Twas brillig, and David Walser at 06/02/13 18:28 did gyre and gimble: [...] What I guess we could to to avoid putting rsyslog on the physical media would be to put a versioned conflicts in the main systemd package with rsyslog and syslog-ng. Thus the old packages should be removed when upgrading (AIUI). not a really good idea imho, i have a server which uses rsyslog for network remote syslogging... so upgrading that would break this. Only if you upgrade without a network connection. Like I say this suggestion would only cover the cases where there was a desire to remove rsyslog from the physical media (to make room for other stuff). It's only an option tho'. I'm not suggesting it's a solution or not. what about the tty12 bug? can this be fixed with journald? it seems to be a feature that people don't want to lose? Not sure. I'll find out. It should be trivial really... i.e. all it really needs is a journalctl -f command run on tty12. You could craft an agetty command that worked like that easily enough, although there may be something more elegant that is more efficient and cleaner. Col -- Colin Guthrie colin(at)mageia.org http://colin.guthr.ie/ Day Job: Tribalogic Limited http://www.tribalogic.net/ Open Source: Mageia Contributor http://www.mageia.org/ PulseAudio Hacker http://www.pulseaudio.org/ Trac Hacker http://trac.edgewall.org/
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
On Thu, Feb 7, 2013 at 1:30 PM, Colin Guthrie mag...@colin.guthr.ie wrote: 'Twas brillig, and Guillaume Rousse at 07/02/13 12:20 did gyre and gimble: Le 07/02/2013 12:40, AL13N a écrit : 'Twas brillig, and David Walser at 06/02/13 18:28 did gyre and gimble: [...] What I guess we could to to avoid putting rsyslog on the physical media would be to put a versioned conflicts in the main systemd package with rsyslog and syslog-ng. Thus the old packages should be removed when upgrading (AIUI). not a really good idea imho, i have a server which uses rsyslog for network remote syslogging... so upgrading that would break this. Indeed. Just because journal is installed (no choice here) shouldn't prevent to install a real syslog-daemon. I'd rather introduce another virtual package, such as syslog-daemon-minimal (or anything else), and lower the dependencies of basesystem to just require this last one. I'm not really sure what that gains... i.e. that's that's effectively what we have right now with the current provides of syslog-daemon via systemd itself. Arguably the semantics are wrong... e.g. it should really be called system-logger or something more generic. But as things stand you no longer *need* to install rsyslog et al - it's just an option. And as things stand right now, if rsyslog is included in the media it will be upgraded happily and keep on running. I was wondering if some packages(like fail2ban) may want to require a traditional syslog
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
'Twas brillig, and Pascal Terjan at 07/02/13 13:35 did gyre and gimble: On Thu, Feb 7, 2013 at 1:30 PM, Colin Guthrie mag...@colin.guthr.ie wrote: 'Twas brillig, and Guillaume Rousse at 07/02/13 12:20 did gyre and gimble: Le 07/02/2013 12:40, AL13N a écrit : 'Twas brillig, and David Walser at 06/02/13 18:28 did gyre and gimble: [...] What I guess we could to to avoid putting rsyslog on the physical media would be to put a versioned conflicts in the main systemd package with rsyslog and syslog-ng. Thus the old packages should be removed when upgrading (AIUI). not a really good idea imho, i have a server which uses rsyslog for network remote syslogging... so upgrading that would break this. Indeed. Just because journal is installed (no choice here) shouldn't prevent to install a real syslog-daemon. I'd rather introduce another virtual package, such as syslog-daemon-minimal (or anything else), and lower the dependencies of basesystem to just require this last one. I'm not really sure what that gains... i.e. that's that's effectively what we have right now with the current provides of syslog-daemon via systemd itself. Arguably the semantics are wrong... e.g. it should really be called system-logger or something more generic. But as things stand you no longer *need* to install rsyslog et al - it's just an option. And as things stand right now, if rsyslog is included in the media it will be upgraded happily and keep on running. I was wondering if some packages(like fail2ban) may want to require a traditional syslog https://github.com/fail2ban/fail2ban/pull/82 ;) But yes, that's a valid argument. Is anyone against the name system-logger? If so I'll update things accordingly. Other name suggestions welcome. Col -- Colin Guthrie colin(at)mageia.org http://colin.guthr.ie/ Day Job: Tribalogic Limited http://www.tribalogic.net/ Open Source: Mageia Contributor http://www.mageia.org/ PulseAudio Hacker http://www.pulseaudio.org/ Trac Hacker http://trac.edgewall.org/
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
'Twas brillig, and David Walser at 07/02/13 15:35 did gyre and gimble: --- On Thu, 2/7/13, Colin Guthrie mag...@colin.guthr.ie wrote: From: Colin Guthrie mag...@colin.guthr.ie Subject: Re: [Mageia-dev] [RFC] rsyslog vs journalctl To: Mageia development mailing-list mageia-dev@mageia.org Cc: David Walser luigiwal...@yahoo.com Date: Thursday, February 7, 2013, 4:56 AM 'Twas brillig, and David Walser at 06/02/13 18:28 did gyre and gimble: Colin Guthrie mageia@... writes: Oh, for the avoidance of doubt, I don't think there is any argument that would suggest the removal from the repositories or obsoletion of rsyslog or syslog-ng etc. I agree, and that's consistent with what you've said in the past. I thought it was odd that the idea of obsoleting them came up yesterday in the packager meeting, but it did. The main reason was wanting to know if rsyslog should still be on the DVD, in case of users using it to upgrade from Mageia 2. It may be the case that not upgrading that particular package during the DVD upgrade won't *break* anything and it can just be upgraded after the system is booted and urpmi sources are added, in which case it doesn't *need* to be on the DVD. Otherwise, we should make sure it's on there. What I guess we could to to avoid putting rsyslog on the physical media would be to put a versioned conflicts in the main systemd package with rsyslog and syslog-ng. Thus the old packages should be removed when upgrading (AIUI). I don't agree with unexpectedly forcibly removing it from people's systems. Do we even know if it hurts anything to leave the mga2 package installed for a few minutes? rsyslog and it's packaging in relation to systemd has certainly changed a lot... dunno exactly how much harm it would do but it would be a combination we'd need to cover in QA to make sure. Better if it can just be avoided if possible (i.e. include it on the physical media for now). Col -- Colin Guthrie colin(at)mageia.org http://colin.guthr.ie/ Day Job: Tribalogic Limited http://www.tribalogic.net/ Open Source: Mageia Contributor http://www.mageia.org/ PulseAudio Hacker http://www.pulseaudio.org/ Trac Hacker http://trac.edgewall.org/
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
--- On Thu, 2/7/13, Colin Guthrie mag...@colin.guthr.ie wrote: rsyslog and it's packaging in relation to systemd has certainly changed a lot... dunno exactly how much harm it would do but it would be a combination we'd need to cover in QA to make sure. Better if it can just be avoided if possible (i.e. include it on the physical media for now). It certainly would be better to have it on there, but I just tried installing the mga2 rsyslog package on Cauldron and it installed just fine, so it shouldn't break any upgrades if it's not on the DVD.
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
On Thu, Feb 07, 2013 at 07:40:51PM +0100, AL13N wrote: Op donderdag 7 februari 2013 13:34:06 schreef Colin Guthrie: 'Twas brillig, and AL13N at 07/02/13 11:40 did gyre and gimble: [...] what about the tty12 bug? can this be fixed with journald? it seems to be a feature that people don't want to lose? Not sure. I'll find out. It should be trivial really... i.e. all it really needs is a journalctl -f command run on tty12. You could craft an agetty command that worked like that easily enough, although there may be something more elegant that is more efficient and cleaner. since the tty12 feature is present now, it would be nice if it could still be there and started as soon as possible, just like before. and still possible to turn off :P -- Regards, Olav
[Mageia-dev] [RFC] rsyslog vs journalctl
Hi there There was a discussion yesterday evening in packager meeting about what we should do with rsyslog. It's needed for upgrade from Mageia 2. But journalctl is now installed by default. Is there some requirement for systemd ? Shall we have both installed? We need an answer to deal with upgrade and isos Cheers -- Anne http://mageia.org
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
On Wed, Feb 06, 2013 at 09:43:41AM +0100, Anne Nicolas wrote: There was a discussion yesterday evening in packager meeting about what we should do with rsyslog. It's needed for upgrade from Mageia 2. But journalctl is now installed by default. Is there some requirement for systemd ? Shall we have both installed? We need an answer to deal with upgrade and isos By default Mageia 3 should only have journalctl. Optionally you can still install rsyslog. Any syslog package will store the same information as journalctl does. Installing this by default provides little benefit, so it was decided that we only do journalctl by default. If installed, you double the storage used for logs. Not sure how to handle an upgrade. rsyslog should still be in the repository, but no idea if Mageia has something like a distro upgrade actions (probably best to explicitly remove rsyslog when using the installer to upgrade.. keep rsyslog when using urpmi). -- Regards, Olav
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
On 06/02/13 09:52, Olav Vitters wrote: By default Mageia 3 should only have journalctl. Optionally you can still install rsyslog. Any syslog package will store the same information as journalctl does. Installing this by default provides little benefit, so it was decided that we only do journalctl by default. If installed, you double the storage used for logs. Something I mentioned a while ago is the memory resources taken by systemd-journald vs rsyslog; it is an order of magnitude greater. We don't care with modern machines, but I would let the option available for old small RAM computers (or reduce the systemd-journal mem resources). Cheers, Chris.
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
On Wed, Feb 06, 2013 at 10:35:12AM +0100, EatDirt wrote: On 06/02/13 09:52, Olav Vitters wrote: By default Mageia 3 should only have journalctl. Optionally you can still install rsyslog. Any syslog package will store the same information as journalctl does. Installing this by default provides little benefit, so it was decided that we only do journalctl by default. If installed, you double the storage used for logs. Something I mentioned a while ago is the memory resources taken by systemd-journald vs rsyslog; it is an order of magnitude greater. We don't care with modern machines, but I would let the option available for old small RAM computers (or reduce the systemd-journal mem resources). Are you sure that there still is a problem? There were some bugs that have been fixed months ago. Aside from that the memory usage could be off as journal uses mmap. But systemd always uses the journal (not runtime configurable IIRC), so best to make it efficient. It should also somehow be low maintenance. Meaning: maybe it will use less memory when there is less available (guessing)? -- Regards, Olav
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
'Twas brillig, and Anne Nicolas at 06/02/13 08:43 did gyre and gimble: There was a discussion yesterday evening in packager meeting about what we should do with rsyslog. It's needed for upgrade from Mageia 2. But journalctl is now installed by default. Is there some requirement for systemd ? Shall we have both installed? We need an answer to deal with upgrade and isos At present the main systemd package provides syslog and also creates the folder /var/log/journal which is what enables persistent logging with the journal (without this folder it just logs into /run/log/journal and keeps it in memory rotating away as needed over time) I did this to push the journal generally in cauldron and get it used and see how things go. If required, I can split this into a separate package (systemd-persistent-journal-logging) which simply provides syslog and the folder /var/log/journal This would allow users to pick whether they want persistent logging with journal or rsyslog (vs. the current choice of only being able to pick rsyslog *in addition* to persistent logging). An alternative is to simply document to people how to change the journal space requirements such that even if persistent logging is enabled, it will not take up too much room and purge itself quite aggressively. I suppose the final decision should be based on what kind of experience we ultimately want to provide in our tools. If I get a chance I can take a quick look at the drakservices and draklog to see what simple stuff I could hack in. The options for really nice, service-specific log searching and viewing are really opened if we force the journal persistent logs. So if I were to choose, I'd leave everything as it is. Persistent journal logging is enabled always but rsyslog is available as an option. This also has the advantage of meaning we, as bug triagers and debuggers, always know where to look for extracting the relevant logs. As Thomas mentioned to me over the weekend, we need a consistent command to extract the needed info. I said that I would work on ensuring such a command was included and thus available on the live media too should people need to use that to boot a broken machine to extract debug info. But I am also happy to concede to popular opinion here. Col -- Colin Guthrie colin(at)mageia.org http://colin.guthr.ie/ Day Job: Tribalogic Limited http://www.tribalogic.net/ Open Source: Mageia Contributor http://www.mageia.org/ PulseAudio Hacker http://www.pulseaudio.org/ Trac Hacker http://trac.edgewall.org/
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
'Twas brillig, and Anne Nicolas at 06/02/13 08:43 did gyre and gimble: There was a discussion yesterday evening in packager meeting about what we should do with rsyslog. It's needed for upgrade from Mageia 2. But journalctl is now installed by default. Is there some requirement for systemd ? Shall we have both installed? We need an answer to deal with upgrade and isos [...] I'm afraid it might not be as easy as anyone would think: 1. journald does not do UDP remote syslogging, according to lennart at his talk at FOSDEM? == this means old syslog shouldn't be obsoleted 2. it appears it also doesn't fill tty12 with info as rsyslog does == if true, and not fixable, then i would still suggest to have both.
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
'Twas brillig, and AL13N at 06/02/13 12:02 did gyre and gimble: 'Twas brillig, and Anne Nicolas at 06/02/13 08:43 did gyre and gimble: There was a discussion yesterday evening in packager meeting about what we should do with rsyslog. It's needed for upgrade from Mageia 2. But journalctl is now installed by default. Is there some requirement for systemd ? Shall we have both installed? We need an answer to deal with upgrade and isos [...] I'm afraid it might not be as easy as anyone would think: 1. journald does not do UDP remote syslogging, according to lennart at his talk at FOSDEM? == this means old syslog shouldn't be obsoleted 2. it appears it also doesn't fill tty12 with info as rsyslog does == if true, and not fixable, then i would still suggest to have both. Oh, for the avoidance of doubt, I don't think there is any argument that would suggest the removal from the repositories or obsoletion of rsyslog or syslog-ng etc. There are perfectly valid reasons to have rsyslog et al installed and I do not envisage us removing this possibility. The only question (in my mind) is whether we should always require disk-based journal logging (and document how to keep that small if the user so desires) or whether we should allow the option to disable persistent journal logging completely. For me I'd rather go the former which allows us to provide a tool that looks in one place for debug info rather than aggregate data lots of separate files. But as I said in my other message, I'm not totally married to that idea. Col -- Colin Guthrie colin(at)mageia.org http://colin.guthr.ie/ Day Job: Tribalogic Limited http://www.tribalogic.net/ Open Source: Mageia Contributor http://www.mageia.org/ PulseAudio Hacker http://www.pulseaudio.org/ Trac Hacker http://trac.edgewall.org/
Re: [Mageia-dev] [RFC] rsyslog vs journalctl
Colin Guthrie mageia@... writes: Oh, for the avoidance of doubt, I don't think there is any argument that would suggest the removal from the repositories or obsoletion of rsyslog or syslog-ng etc. I agree, and that's consistent with what you've said in the past. I thought it was odd that the idea of obsoleting them came up yesterday in the packager meeting, but it did. The main reason was wanting to know if rsyslog should still be on the DVD, in case of users using it to upgrade from Mageia 2. It may be the case that not upgrading that particular package during the DVD upgrade won't *break* anything and it can just be upgraded after the system is booted and urpmi sources are added, in which case it doesn't *need* to be on the DVD. Otherwise, we should make sure it's on there.
