[syslog-ng] How to roll journald cursor in persist file
Matwey V. Kornilov
matwey.kornilov at gmail.com
Tue May 31 12:04:45 CEST 2016
Hello,
I am running syslog-ng 3.7.1 and journald v210. The goal I want to reach
is the following.
I would like to replicate local system logs to remote endpoint using
standard UDP protocol.
So, I've just disabled all destinations except the following one:
destination logserver { udp("10.0.0.47" port(514)); };
log { source(src); destination(logserver); };
The issue is the following. It seems that syslog-ng 3.7.1 uses journald
natively for system() source. And I like it. The issue is that when I
start syslog-ng it tries to sync all existing local journald data (about
5 GB of compressed journald data, 1.5 years of logs) from the beginning.
I found in modules/systemd-journal/journal-reader.c that syslog-ng
stores journald cursor in the persists file. I would like to point the
cursor to the end of journald database in order to avoid unneeded log sync.
The question is how could I do that in opensource syslog-ng version?
More information about the syslog-ng
mailing list