combined local and remote journald logs
I am using journald forwarding using systemd-journal-remote
(local site) and systemd-journal-upload
(remote site) on centos7 with systemd-219 on both machines.
Local journals are stored in /var/log/journal/<machine_id>/*.journal
whereas remote uploads are stored in /var/log/journal/remote/remote-*.journal
.
I'm able to view both seperatly using journalctl -lf
or journalctl -D /var/log/journal/remote -lf
.
I am now trying to get a combined view using journalctl -m
, where the man page says that it would show entries from all available journals, including remote ones, but that doesn't seem to work, at least not the way I'd expect, because the journals aren't merged in any way.
Using SYSTEMD_LOG_LEVEL=debug journalctl -lfm
gives hints about the included journal files:
Root directory /var/log/journal added.
Considering /var/log/journal/fb643c7c40aa414aab4fe052ee7aff57.
Directory /var/log/journal/fb643c7c40aa414aab4fe052ee7aff57 added.
File /var/log/journal/fb643c7c40aa414aab4fe052ee7aff57/system.journal added.
File /var/log/journal/fb643c7c40aa414aab4fe052ee7aff57/user-1001.journal added.
File /var/log/journal/fb643c7c40aa414aab4fe052ee7aff57/user-1000.journal added.
Journal filter: none
Considering /var/log/journal/fb643c7c40aa414aab4fe052ee7aff57.
... journal output ...
Is there a way to achive a merged view of all journals, by which I mean all journal files located somewhere under /var/log/journal/
?
Solution 1:
The fix appears to be coming in https://github.com/systemd/systemd/pull/4970
Solution 2:
I can't find how to set other search path.
Workaround: override the systemd-journal-remote service where set the --output=/var/log/journal instead of /var/log/journal/remote/.
Don't forget take care proper permission settings.