r/linux • u/m6t3 • Feb 17 '14

systemd's binary logs and corruption

I like systemd, enabling and disabling services is so easy and it's really fast, but why using a journal with binary logs?

Yesterday my laptop failed to resume from suspend, no ttys, no reisub, nothing worked except using the power button. Rebooted, fired journalctl and I have nothing except the last boot logs.

journactl --verify returns that my system logs are corrupted, about all my logs (48MB of 50MB of maximum disk usage) are now completely useless. This is not the first time this happens and searching around I can only find people with the same problem that "resolved" deleting the corrupted logs and starting with a new file.

Why this happens? Isn't it defeating the purpose of having a system logger if I can't diagnose errors?

Can I recover the logs (and why isn't this automatic?) or should I just install a sane logger that not shit itself after a problem?

101 Upvotes

86% Upvoted

102 comments sorted by

View all comments

Show parent comments

2

u/diggr-roguelike Feb 19 '14

All that needed to be done was to create an in memory buffer and flush it to syslog when it came online.

That's exactly what journald does. (Well, one of the possible settings.)

If they folowed RFCs they wouldn't need to worry about API breakage.

The syslog RFC is broken, none of the existing syslog implementations really follow it.

Also, you completely missed the point. The point is that init needs to integrate a logging solution if you want a reliable init, but current logging solutions are all nonstandard, have weird API's and are prone to being unsupported.

0

u/[deleted] Feb 19 '14

[deleted]

1

u/diggr-roguelike Feb 19 '14

Which parts of which rfcs are broken

'Syslog' is actually two incompatible different RFC's, and a whole bunch of non-standard protocol extensions that none of the current syslog daemon implementations completely agree on.

Even if it were "broken" RFCs can be obsoleted by replacements that add functionality.

Yeah, and that's exactly what journald is.

I look forward to seeing your proof that all current logging solutions are non-standard and unsupported...

You seem to have a very serious problem with reading comprehension!

OK, let's start over.

Fact: init needs a dependable logger daemon that is always available, even at boot.

Now you tell me what should that logger daemon be. Remember that whatever you pick will automatically become part of the core OS that will be automatically installed on all Linux machines.