Re: [gentoo-user] Syslog-ng "Failed to seek to the Cursor"

[Rich Freeman <rich0@gentoo.org>]

On Wed, Sep 16, 2015 at 12:55 PM, Alan McKinnon <alan.mckinnon@gmail.com> wrote:
>
> It has something to do with systemd's log thingy.
>
> The error only appears in one place in the syslog-ng source,
> in modules/systemd-journal/journal-reader.c:
>
> static inline gboolean
> __seek_to_saved_state(JournalReader *self)
> {
>   JournalReaderState *state =
> persist_state_map_entry(self->persist_state, self->persist_handle);
>   gint rc = journald_seek_cursor(self->journal, state->cursor);
>   persist_state_unmap_entry(self->persist_state, self->persist_handle);
>   if (rc != 0)
>     {
>       msg_warning("Failed to seek to the cursor",
>           evt_tag_str("cursor", state->cursor),
>           evt_tag_errno("error", errno),
>           NULL);
>       return __seek_to_head(self);
>     }
>   journald_next(self->journal);
>   return TRUE;
> }
>

The other posts are getting at the solution - disable journal support
if you're not actually using systemd.

However, does syslog-ng actually READ logs?  My understanding is that
journal cursors are used to read logs, not to write them, and I
associate syslog-ng more with writing logs.

The concept is that when you query the journal every record gets
returned with a cursor, which is just a guid of some sort.  Then you
can run a later query and pass the last cursor you saw back and just
get a list of new records since the last one you read.  The use case
is for log monitors and such so that they can periodically poll the
log without having to read the entire thing from the beginning each
time.

-- 
Rich