Re: [gentoo-user] Syslog-ng "Failed to seek to the Cursor"

[Rich Freeman <rich0@gentoo.org>]

On Wed, Sep 16, 2015 at 3:57 PM, Alan McKinnon <alan.mckinnon@gmail.com> wrote:
> On 16/09/2015 21:42, Rich Freeman wrote:
>> On Wed, Sep 16, 2015 at 12:55 PM, Alan McKinnon <alan.mckinnon@gmail.com> wrote:
>>>
>>> It has something to do with systemd's log thingy.
>>>
>>> The error only appears in one place in the syslog-ng source,
>>> in modules/systemd-journal/journal-reader.c:
>>>
>>> static inline gboolean
>>> __seek_to_saved_state(JournalReader *self)
>>> {
>>>   JournalReaderState *state =
>>> persist_state_map_entry(self->persist_state, self->persist_handle);
>>>   gint rc = journald_seek_cursor(self->journal, state->cursor);
>>>   persist_state_unmap_entry(self->persist_state, self->persist_handle);
>>>   if (rc != 0)
>>>     {
>>>       msg_warning("Failed to seek to the cursor",
>>>           evt_tag_str("cursor", state->cursor),
>>>           evt_tag_errno("error", errno),
>>>           NULL);
>>>       return __seek_to_head(self);
>>>     }
>>>   journald_next(self->journal);
>>>   return TRUE;
>>> }
>>>
>>
>> The other posts are getting at the solution - disable journal support
>> if you're not actually using systemd.
>>
>> However, does syslog-ng actually READ logs?  My understanding is that
>> journal cursors are used to read logs, not to write them, and I
>> associate syslog-ng more with writing logs.
>>
>> The concept is that when you query the journal every record gets
>> returned with a cursor, which is just a guid of some sort.  Then you
>> can run a later query and pass the last cursor you saw back and just
>> get a list of new records since the last one you read.  The use case
>> is for log monitors and such so that they can periodically poll the
>> log without having to read the entire thing from the beginning each
>> time.
>>
>
>
> Digging up ancient memory from other people's posts long ago:
>
> Doesn't syslog-ng read systemd's log from early userspace startup
> (before syslog-ng starts) and write those entries to syslog-ng?
>

Ah, that makes sense.  This isn't about recording syslog data in the
journal.  This is about recording journal data in syslog, for which
using cursors would be a completely obvious design.

-- 
Rich