search

travelping / journal-gateway-gelf

journal-gateway-gelf
8 stars 7 forks source link

add option to track last message sent #11

Open sschindler89 opened 7 years ago

sschindler89 commented 7 years ago

the forwarder sends all messages on the machine to the Graylog2 server. This is repeated after a restart. In order to keep the ability to send old messages, an option should be introduced to save the current "state" which would just be "last message sent" based upon the pointer of the journal entry.

hwinkel commented 7 years ago

why not sending just messages since last boot?

journalctl --boot

sschindler89 commented 7 years ago

👍 a flag telling the forwarder since which boot (like --boot for journalctl) messages should be sent should do the job. nobody wants to manually specify some message id and some duplicated messages should be ok.

mgumz commented 7 years ago

@hwinkel sending messages since last boot (of the OS) does not help: a restart (eg, caused by a crash of the forwarder itself) of the forwarder starts to send in all the data since the last boot .. which is ~ 3 months or more on the production servers we know about.

@ContentSafe the code already contains (underdocumented) environment variables like JOURNAL_EXPORT_FROM ("since") and JOURNAL_EXPORT_TO ("until") to send in ranges of log messages.

right now, I am convinced that per default, journal-gateway-gelf should start sending all new messages. IF an operator needs older messages, JOURNAL_EXPORT_FROM and JOURNAL_EXPORT_TO are there.

the alternative of storing the last processed cursor or timestamp after every message or after n seconds to $some-place which should survive a reboot but also should not introduce hard-coupling sending messages to fsync on the filesystem, all look worse to me, the longer i look at them.

hwinkel commented 7 years ago

even better if we have a more close the last message selector.

b0ch3nski commented 7 years ago

@sschindler89 @hwinkel @mgumz As far as I remember systemd-journal-upload (the official remote solution) knows what was the last log sent by saving CURSOR value on disk. It seems like a best approach to me.