On Sun, 27 Oct 2013 18:41:36 +0200 Dimitris Zervas <dzervas@dzervas.gr> wrote:
I have to say that I really hate journalctl. But apart from that, I need syslog. Journalctl requires too much resources (I have a 512MB KVM) and some times it kicks the server out of memory.
I'm not sure what you mean. Does the systemd-journald process take too much memory, or you store logs in RAM and they become too large?
Also, there is nearly no way to parse its logs with any log analyzers, you have to do it the hackish way with "journalctl -o export" which is very heavyweight and requires a whole shell process to do so. I just want to completely disable journalctl and use syslog-ng like the good old days. Any help on how to do that? I did my h/w (googled it) but I got no helpful results... Any help appreciated! :)
You can't disable journald because it is a required module of systemd. However, you can tell journald to not log anything in /etc/systemd/journald.conf (Storage=none). Notice though that syslog-ng under systemd may have an incomplete log. In addition, I'm not sure what happens to timestamps. Both journald and syslog-ng do support high-precision timestamping with journald using them by default. However, I don't know what time will syslog-ng record... -- Leonid Isaev GnuPG key: 0x164B5A6D Fingerprint: C0DF 20D0 C075 C3F1 E1BE 775A A7AE F6CB 164B 5A6D