I'm seeing an issue where the copying/forwarding of journal messages to /var/log/syslog
seems to be delayed:
theuser@host:/etc/systemd$ sudo journalctl -n 1 && sudo tail -n 1 /var/log/syslog
-- Logs begin at Wed 2018-12-12 09:52:03 CST, end at Fri 2018-12-14 08:41:20 CST. --
Dec 14 08:41:20 host sudo[26760]: pam_unix(sudo:session): session opened for user root by theuser(uid=0)
Dec 14 07:40:12 host sudo[2574]: *log message snipped*
I've confirmed that /etc/systemd/journald.conf
has not set ForwardToSyslog=no
(the default value of yes
is presumably being used).
该问题偶尔出现,并且通常似乎可以通过重新启动来解决,但是我希望也许能得到一些有关应该检查的内容/可能引起此问题的建议,以便可以在当前遇到问题的系统上四处浏览。
One other piece of probably-relevant information is that I'm using rsyslog
to forward logs from /var/log/syslog
to an external log aggregation service.