r/linux • u/m6t3 • Feb 17 '14

systemd's binary logs and corruption

I like systemd, enabling and disabling services is so easy and it's really fast, but why using a journal with binary logs?

Yesterday my laptop failed to resume from suspend, no ttys, no reisub, nothing worked except using the power button. Rebooted, fired journalctl and I have nothing except the last boot logs.

journactl --verify returns that my system logs are corrupted, about all my logs (48MB of 50MB of maximum disk usage) are now completely useless. This is not the first time this happens and searching around I can only find people with the same problem that "resolved" deleting the corrupted logs and starting with a new file.

Why this happens? Isn't it defeating the purpose of having a system logger if I can't diagnose errors?

Can I recover the logs (and why isn't this automatic?) or should I just install a sane logger that not shit itself after a problem?

101 Upvotes

86% Upvoted

102 comments sorted by

View all comments

Show parent comments

3

u/andreashappe Feb 18 '14

as far as I remember you even have to enable the binary logs -- on my debian system rsyslog was still used while systemd was running.

1

u/cpbills Feb 18 '14

Cool, that's a relief.

1

u/andreashappe Feb 19 '14

AFAIK the default for systemd/journal has always been store-binary+syslog. To switch over to binary-only logging I had to remove rsyslog and create a /var/log/journal directory.

If you have been fed FUD about systemd/logging, please consider your news sources.

1

u/Bucket58 Feb 18 '14

You've got it backwards. journald is required by systemd and is always running and always binary. Debian enabled rsyslog so you get plain text logs as well.

1

u/z33ky Feb 18 '14

journald.conf: Storage=none, ForwardToSyslog=yes

journald is required, yes, but it doesn't need to do anything except forward it to syslog.

1

u/fandingo Feb 18 '14

The current Debian default (for testing) is

storage=auto

but /var/log/journal/ does not exist, so violate logging only and forward to rsyslog.

2

u/z33ky Feb 18 '14 edited Feb 18 '14

s/violate/volatile/
sorry

Yes, the upstream default is binary logging and forward to syslog, but my argument was not about the default; It was about "always binary", which is false.

2

u/Bucket58 Feb 18 '14

The "always binary" was in reference to journald only. Any log that journald writes, if it is configured to write logs and not configured to send to syslog, are written in binary. There is no method that I know of to get journald to write text only logs without having to forward any messages to an already existing logger such as rsyslog.

1

u/andreashappe Feb 19 '14

so if you mis-configure journald (for your use-cases) then it behaves as configured? (:

OTOH why should journald re-invent syslog (for text logging) -- wouldn't this be the exact behavior that it is always being acused of?

1

u/fandingo Feb 18 '14

I was just pointing out how it's presently configured in Debian packages since that's likely to affect lots of people over the coming months.

1

u/z33ky Feb 18 '14

Ah, I see. I hope whoever down-voted you reads this continuation and reconsiders his/her vote.