[arch-general] Replacing journal completely with syslog-ng

[Leonid Isaev]

On Sun, 27 Oct 2013 18:41:36 +0200
Dimitris Zervas <dzervas at dzervas.gr> wrote:

> I have to say that I really hate journalctl.
> But apart from that, I need syslog.
> Journalctl requires too much resources (I have a 512MB KVM) and some times
> it kicks the server out of memory.

I'm not sure what you mean. Does the systemd-journald process take too much
memory, or you store logs in RAM and they become too large?

> Also, there is nearly no way to parse its logs with any log analyzers, you
> have to do it the hackish way with "journalctl -o export" which is very
> heavyweight and requires a whole shell process to do so.
> I just want to completely disable journalctl and use syslog-ng like the
> good old days.
> Any help on how to do that?
> I did my h/w (googled it) but I got no helpful results...
> Any help appreciated! :)

You can't disable journald because it is a required module of systemd.
However, you can tell journald to not log anything
in /etc/systemd/journald.conf (Storage=none).

Notice though that syslog-ng under systemd may have an incomplete log. In
addition, I'm not sure what happens to timestamps. Both journald and syslog-ng
do support high-precision timestamping with journald using them by default.
However, I don't know what time will syslog-ng record...

-- 
Leonid Isaev
GnuPG key: 0x164B5A6D
Fingerprint: C0DF 20D0 C075 C3F1 E1BE  775A A7AE F6CB 164B 5A6D
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: not available
URL: <http://mailman.archlinux.org/pipermail/arch-general/attachments/20131027/f85f8d0b/attachment.asc>