Up until version 4.12, when syslog-ng ran into an error jumping to a saved systemd journal position, it read the journal from the beginning. With the latest syslog-ng version, you can configure what happens in case of such an error.
Before you begin
You need at least syslog-ng version 4.12 for the read-old-on-error() option.
Why does this matter?
In most cases, reading from the journal works just fine. Syslog-ng stores the last reading position in a file, so whatever happens, it can keep reading logs from that location. By default, if a stored position cannot be found, syslog-ng reads the journal from the beginning. This is not a problem in most cases, as the most common reason for this problem is a deleted journal file. In this case, syslog-ng only has to read a few log messages.
However, there are cases when there are gigabytes of logs stored in a journal, but for whatever reasons, the journal cannot seek to the requested position. In this case syslog-ng reads logs from the beginning of the journal. Reading large amount of logs from the journal can influence host performance. It can also cause many duplicate log messages, wasting many gigabytes of disk space.
Choose your poison
Up until now syslog-ng stayed on the safe side: in case of an error, it read all logs from the beginning. Message loss was avoided; however, it could waste a lot of disk space. From version 4.12, you can configure syslog-ng to skip to the end of the journal and start reading logs from there. A few messages might be lost, but you do not waste gigabytes of storage for logs which are already saved.
Configuring syslog-ng
If you are OK with reading the journal from the beginning on error, you do not have to do anything. In any other cases, add the following to your systemd-journald() source:
read-old-on-error(no)
This ensures that on a read error, syslog-ng keeps reading from the end of the journal.
-
If you have questions or comments related to syslog-ng, do not hesitate to contact us. You can reach us by email or even chat with us. For a list of possibilities, check our GitHub page under the “Community” section at https://github.com/syslog-ng/syslog-ng. On Twitter, I am available as @PCzanik, on Mastodon as @Pczanik@fosstodon.org.