Open amdrsantos opened 3 months ago
Indeed, the message about log suppression is not in the tails.log you posted above.
This is a tough one to crack. I was looking at message rates, etc in log_stats.log. One line that I couldn't figure out was this:
0 96f54c06ef73463dbcdd4e17b691f36c Mon 2024-03-25 02:18:15 UTC—Mon 2024-03-25 02:30:02 UTC
I assume this is somehow related to the range of messages present in the journal, is that right?
Also I noticed that syslog-ng was restarted at 15:19:49, which is an hour earlier than the message drop, but what happened there? did you manually restart it?
Hey. Sorry for the delayed response.
It is the output of: journalctl --list-boots
syslog-ng
Version of syslog-ng
Platform
Debug bundle
Not Available
Issue
Failure
On a heavy system, some logs are not being written to the log file. They appear on journald but not on the log file.
Steps to reproduce
Load the system as much as you can, so that journal it self is suppressing messages and the tail writing of the log file is 3 minutes behind the journald.
I used a couple of traces to check if problem is occurring. I set the following jobs in a shell:
As you can see by the extract above, "Mar 25 16:27:34 machine systemd-journald[456]: Suppressed 11133 messages from l0serviceManager.service" did not reach the log file.
Configuration
In attachment
Input and output logs (if possible)
In attachment log_stats.log messages.log tails.log