[lug] Thoughts on upgrading to CentOS 7

[Rob Nagler]

On Sun, Mar 25, 2018 at 4:45 PM, Zan Lynx wrote:
>
> If CentOS defaults to rsyslog, which I think they do, then there's no
> reason to keep the journal around. It's duplicated by rsyslog into the
> regular text logs in /var/log. Then those would be rotated. In that case
> storing journal in temporary storage is a great idea.
>

Again, thanks for trying to help, but as noted, it's not so simple...

When a systemd unit starts, what gets written to syslog is the basename of
the program in ExecStart. That may not have enough information about the
unit. If you've written unit files, you'll learn that systemd is finicky so
rather than learning yet another templating language, we just write a
script that systemd executes so ExecStart=/srv/<unit>/start is the way all
our unit files look like. The output in /var/log/messages therefore becomes:

Mar 25 23:34:45 v3 start: rsync error: unexplained error (code 255) at
io.c(605) [Receiver=3.0.9]

"start" is not the name of the unit. The journal stores the unit name with
each log entry so you have to backup the journal or you will be losing
critical information (among other things like the PID). You really do need
to backup the journal to have a history of what units are doing especially
if you are running containers which (often) output logs to stderr.

To backup and rotate the journal, this is what we came up with:

/var/log/journal.export
{
    create 0600 root root
    dateext
    # Export the log with some overlap so we don't lose entries
    firstaction
        journalctl --since -25h --output export > /var/log/journal.export
    endscript
    # always empty
    ifempty
}

Run this one time after installing the above:

install -m 600 -o root -g root /dev/null /var/log/journal.export

The first time this runs, it won't rotate so you will not backup the first
day's journal after setting up. This is a problem that can be fixed by
initializling /var/lib/logrotate/logrotate.status appropriately.n

Rob
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lug.boulder.co.us/pipermail/lug/attachments/20180325/4d663c04/attachment.html>