On Tue, Apr 26, 2016, 2:09 PM Chris Adams linux@cmadams.net wrote:
I have several recently-installed CentOS 7 servers that keep having systemd-journald corruption
Determined with 'journalctl --verify' or another way?
(which stops ALL logging, including syslog).
Interestingly, they are all spam-scanning servers running amavisd-new (so could be some particular pattern is triggering it).
Is there a "supported" way to just cut systemd-journald out of the picture and have log entries go straight to rsyslogd?
No. Everything reports to journald and rsyslog gets what it wants from journald.
If you are referring to native journald logs corrupting, that should not affect rsyslog. If you remove /var/log/journal then systemd-journald logs will be stored volatile in /run.
Has anyone else seen this?
Sortof, but not in a way that affects rsyslog. Usually journalctl just skips over corrupt parts and systemd-journald will rotate logs when it detects corruption to isolate corrupt files.
Chris Murphy