If you set MaxRetentionSec= for systemd journald, some messages might be lost in the log files that rsyslog saves
Issue
Some messages are missing in /var/log/messages
when MaxRetentionSec=
in systemd journald is set.
# cat /etc/systemd/journald.conf
:
MaxRetentionSec=1day
MaxFileSec=1day
Example:
Given that we set up /etc/systemd/journald.conf
as follows:
# cat /etc/systemd/journald.conf
:
MaxRetentionSec=1day
MaxFileSec=1day
And that we run the following script:
#!/bin/bash
I=1
while [ $I -lt 1000 ]
do
logger " -$I"
I=`expr $I + 1`
done
we expect that the messages are fully saved into /var/log/messages:
# cat /var/log/messages
:
Oct 2 18:34:28 xxxxxx root[23340]: -601
Oct 2 18:34:28 xxxxxx root[23342]: -602
Oct 2 18:34:28 xxxxxx root[23344]: -603
Oct 2 18:34:28 xxxxxx root[23346]: -604
Oct 2 18:34:28 xxxxxx rsyslogd[3805]: imjournal: journal files changed, reloading... [v8.1911.0-3.el8 try https://www.rsyslog.com/e/0 ]
Oct 2 18:34:28 xxxxxx root[23539]: -605
Oct 2 18:34:28 xxxxxx root[23541]: -606
Oct 2 18:34:28 xxxxxx root[23543]: -607
Oct 2 18:34:28 xxxxxx root[23545]: -608
However, we sometimes observe that some messages are missing in /var/log/messages:
# cat /var/log/messages
:
Oct 2 18:34:28 xxxxxx root[23338]: -505
Oct 2 18:34:28 xxxxxx root[23340]: -506
Oct 2 18:34:28 xxxxxx root[23342]: -507
Oct 2 18:34:28 xxxxxx root[23344]: -508
Oct 2 18:34:28 xxxxxx root[23346]: -509
Oct 2 18:34:28 xxxxxx rsyslogd[3805]: imjournal: journal files changed, reloading... [v8.1911.0-3.el8 try https://www.rsyslog.com/e/0 ]
Oct 2 18:34:28 xxxxxx root[23539]: -605
Oct 2 18:34:28 xxxxxx root[23541]: -606
Oct 2 18:34:28 xxxxxx root[23543]: -607
Oct 2 18:34:28 xxxxxx root[23545]: -608
where the messages from -510 to -604 are missing.
Environment
- Red Hat Enterprise Linux (RHEL) 7, 8 and 9
- systemd
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.