[arch-general] Replacing journal completely with syslog-ng
lisaev at umail.iu.edu
Sun Oct 27 15:30:42 EDT 2013
On Sun, 27 Oct 2013 18:41:36 +0200
Dimitris Zervas <dzervas at dzervas.gr> wrote:
> I have to say that I really hate journalctl.
> But apart from that, I need syslog.
> Journalctl requires too much resources (I have a 512MB KVM) and some times
> it kicks the server out of memory.
I'm not sure what you mean. Does the systemd-journald process take too much
memory, or you store logs in RAM and they become too large?
> Also, there is nearly no way to parse its logs with any log analyzers, you
> have to do it the hackish way with "journalctl -o export" which is very
> heavyweight and requires a whole shell process to do so.
> I just want to completely disable journalctl and use syslog-ng like the
> good old days.
> Any help on how to do that?
> I did my h/w (googled it) but I got no helpful results...
> Any help appreciated! :)
You can't disable journald because it is a required module of systemd.
However, you can tell journald to not log anything
in /etc/systemd/journald.conf (Storage=none).
Notice though that syslog-ng under systemd may have an incomplete log. In
addition, I'm not sure what happens to timestamps. Both journald and syslog-ng
do support high-precision timestamping with journald using them by default.
However, I don't know what time will syslog-ng record...
GnuPG key: 0x164B5A6D
Fingerprint: C0DF 20D0 C075 C3F1 E1BE 775A A7AE F6CB 164B 5A6D
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 490 bytes
Desc: not available
More information about the arch-general