If you set MaxRetentionSec= for systemd journald, some messages might be lost in the log files that rsyslog saves

Solution Verified - Updated -

Issue

Some messages are missing in /var/log/messages when MaxRetentionSec= in systemd journald is set.

# cat /etc/systemd/journald.conf
:
MaxRetentionSec=1day
MaxFileSec=1day

Example:

Given that we set up /etc/systemd/journald.conf as follows:

# cat /etc/systemd/journald.conf
:
MaxRetentionSec=1day
MaxFileSec=1day

And that we run the following script:

#!/bin/bash
I=1
while [ $I -lt 1000 ]
do
  logger " -$I"
  I=`expr $I + 1`
done

we expect that the messages are fully saved into /var/log/messages:

# cat /var/log/messages
:
Oct  2 18:34:28 xxxxxx root[23340]: -601
Oct  2 18:34:28 xxxxxx root[23342]: -602
Oct  2 18:34:28 xxxxxx root[23344]: -603
Oct  2 18:34:28 xxxxxx root[23346]: -604
Oct  2 18:34:28 xxxxxx rsyslogd[3805]: imjournal: journal files changed, reloading...  [v8.1911.0-3.el8 try https://www.rsyslog.com/e/0 ]
Oct  2 18:34:28 xxxxxx root[23539]: -605
Oct  2 18:34:28 xxxxxx root[23541]: -606
Oct  2 18:34:28 xxxxxx root[23543]: -607
Oct  2 18:34:28 xxxxxx root[23545]: -608

However, we sometimes observe that some messages are missing in /var/log/messages:

# cat /var/log/messages
:
Oct  2 18:34:28 xxxxxx root[23338]: -505
Oct  2 18:34:28 xxxxxx root[23340]: -506
Oct  2 18:34:28 xxxxxx root[23342]: -507
Oct  2 18:34:28 xxxxxx root[23344]: -508
Oct  2 18:34:28 xxxxxx root[23346]: -509
Oct  2 18:34:28 xxxxxx rsyslogd[3805]: imjournal: journal files changed, reloading...  [v8.1911.0-3.el8 try https://www.rsyslog.com/e/0 ]
Oct  2 18:34:28 xxxxxx root[23539]: -605
Oct  2 18:34:28 xxxxxx root[23541]: -606
Oct  2 18:34:28 xxxxxx root[23543]: -607
Oct  2 18:34:28 xxxxxx root[23545]: -608

where the messages from -510 to -604 are missing.

Environment

  • Red Hat Enterprise Linux (RHEL) 7, 8 and 9
  • systemd

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content