From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id EF6A81393F1 for ; Wed, 16 Sep 2015 20:04:05 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 892D9E0894; Wed, 16 Sep 2015 20:03:55 +0000 (UTC) Received: from mail-qk0-f171.google.com (mail-qk0-f171.google.com [209.85.220.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 4D943E085A for ; Wed, 16 Sep 2015 20:03:54 +0000 (UTC) Received: by qkap81 with SMTP id p81so91808321qka.2 for ; Wed, 16 Sep 2015 13:03:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:content-type; bh=KCV91kalt7vgO8OGsBoKqQgBfP8CeHCWe8IPEHS3Aec=; b=h1uJvq5mVmMBgormcNmt0bEsx7LPpL73Ge3v5IEAMtEHjnm68FItetKQMiQi0k7Pjm jzNDRV7bPSjI65waN90aROXRDxG8r955IYyUwVaLPBZUPYCoiJCFtwSDqK4L2YElDPhM rCFJTa5YXmIMBYij1L6j4YPZOjN7mwU2it0SRqrABbV2S93LMZlF2oUvMXzXHZcxH+iN y8e4DnXLX/2fMz5Gxm4APJn1h5xca0VE4RJJcP9PXb4IdK125jaoDlp9lnzT9wQlf/9F K4NAYDmzQE/1jZEkzMFKsdYXl/tsDReanqx0urrjTfTzFiLiUv8rvrDSdtFKuFrwiTGP CFxw== Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 X-Received: by 10.55.198.28 with SMTP id b28mr44410448qkj.34.1442433833667; Wed, 16 Sep 2015 13:03:53 -0700 (PDT) Sender: freemanrich@gmail.com Received: by 10.140.38.106 with HTTP; Wed, 16 Sep 2015 13:03:53 -0700 (PDT) In-Reply-To: <55F9C9BD.202@gmail.com> References: <55F99EE4.6000902@gmail.com> <55F9C9BD.202@gmail.com> Date: Wed, 16 Sep 2015 16:03:53 -0400 X-Google-Sender-Auth: Km3jkBg8L8UOZDH7QhOmYHGPwaU Message-ID: Subject: Re: [gentoo-user] Syslog-ng "Failed to seek to the Cursor" From: Rich Freeman To: gentoo-user@lists.gentoo.org Content-Type: text/plain; charset=UTF-8 X-Archives-Salt: 8aa8c9fb-d213-4162-9637-463c364257a9 X-Archives-Hash: e524f3c26d4ace8180817108b06d05e9 On Wed, Sep 16, 2015 at 3:57 PM, Alan McKinnon wrote: > On 16/09/2015 21:42, Rich Freeman wrote: >> On Wed, Sep 16, 2015 at 12:55 PM, Alan McKinnon wrote: >>> >>> It has something to do with systemd's log thingy. >>> >>> The error only appears in one place in the syslog-ng source, >>> in modules/systemd-journal/journal-reader.c: >>> >>> static inline gboolean >>> __seek_to_saved_state(JournalReader *self) >>> { >>> JournalReaderState *state = >>> persist_state_map_entry(self->persist_state, self->persist_handle); >>> gint rc = journald_seek_cursor(self->journal, state->cursor); >>> persist_state_unmap_entry(self->persist_state, self->persist_handle); >>> if (rc != 0) >>> { >>> msg_warning("Failed to seek to the cursor", >>> evt_tag_str("cursor", state->cursor), >>> evt_tag_errno("error", errno), >>> NULL); >>> return __seek_to_head(self); >>> } >>> journald_next(self->journal); >>> return TRUE; >>> } >>> >> >> The other posts are getting at the solution - disable journal support >> if you're not actually using systemd. >> >> However, does syslog-ng actually READ logs? My understanding is that >> journal cursors are used to read logs, not to write them, and I >> associate syslog-ng more with writing logs. >> >> The concept is that when you query the journal every record gets >> returned with a cursor, which is just a guid of some sort. Then you >> can run a later query and pass the last cursor you saw back and just >> get a list of new records since the last one you read. The use case >> is for log monitors and such so that they can periodically poll the >> log without having to read the entire thing from the beginning each >> time. >> > > > Digging up ancient memory from other people's posts long ago: > > Doesn't syslog-ng read systemd's log from early userspace startup > (before syslog-ng starts) and write those entries to syslog-ng? > Ah, that makes sense. This isn't about recording syslog data in the journal. This is about recording journal data in syslog, for which using cursors would be a completely obvious design. -- Rich