systemd, as is its nature, subsumes into itself a number of facilities that historically have separate processes and utilities.

In particular, system logging is now part of systemd, recorded in binary files, and accessible via the journalctl utility.

And while systemd has some compelling aspects, logging is somewhere I wanted to continue to use syslog-ng and logrotate to have a familiar experience and easily tailable, grepable files.

Both of these packages have support for integration with systemd and journald.

As well, with this OS image, I wanted to minimize writes to the boot/root filesystem, to prevent excess wear on the flash storage.

A key component of this is to reconfigure journald (/etc/systemd/journald.conf): for Storage=volatile. This will ensure that the journal is only retained in memory. While you're at it, set RuntimeMaxUse to something reasonable. Note that you really are only going to need this to be large enough to spool syslogs for the period of time before syslog-ng starts up and can start consuming the logs from journald to be put into persistent storage.

Then, simply configure syslog-ng with:

    # /etc/syslog-ng/syslog-ng.conf
    source src { systemd-journal(); [...] };

...to consume logs from journald once it starts. In my case, I have it configured to spool logs to:

    # /etc/syslog-ng/syslog-ng.confg
    destination messages { file("/data/system/var/log/messages"); };

Published

Category

Posts

Tags

Contact