Linux – combined local and remote journald logs

journalctljournaldlinuxsystemd

I am using journald forwarding using systemd-journal-remote (local site) and systemd-journal-upload (remote site) on centos7 with systemd-219 on both machines.

Local journals are stored in /var/log/journal/<machine_id>/*.journal whereas remote uploads are stored in /var/log/journal/remote/remote-*.journal.

I'm able to view both seperatly using journalctl -lf or journalctl -D /var/log/journal/remote -lf.

I am now trying to get a combined view using journalctl -m, where the man page says that it would show entries from all available journals, including remote ones, but that doesn't seem to work, at least not the way I'd expect, because the journals aren't merged in any way.

Using SYSTEMD_LOG_LEVEL=debug journalctl -lfm gives hints about the included journal files:

Root directory /var/log/journal added.
Considering /var/log/journal/fb643c7c40aa414aab4fe052ee7aff57.
Directory /var/log/journal/fb643c7c40aa414aab4fe052ee7aff57 added.
File /var/log/journal/fb643c7c40aa414aab4fe052ee7aff57/system.journal added.
File /var/log/journal/fb643c7c40aa414aab4fe052ee7aff57/user-1001.journal added.
File /var/log/journal/fb643c7c40aa414aab4fe052ee7aff57/user-1000.journal added.
Journal filter: none
Considering /var/log/journal/fb643c7c40aa414aab4fe052ee7aff57.
... journal output ...

Is there a way to achive a merged view of all journals, by which I mean all journal files located somewhere under /var/log/journal/?

Best Answer

The fix appears to be coming in https://github.com/systemd/systemd/pull/4970

Related Topic