{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin-aggregated-logging/issues/142","repository_url":"https://api.github.com/repos/openshift/origin-aggregated-logging","labels_url":"https://api.github.com/repos/openshift/origin-aggregated-logging/issues/142/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin-aggregated-logging/issues/142/comments","events_url":"https://api.github.com/repos/openshift/origin-aggregated-logging/issues/142/events","html_url":"https://github.com/openshift/origin-aggregated-logging/pull/142","id":155854702,"number":142,"title":"[WIP] Allow reading system logs from the journal instead of /var/log/messages","user":{"login":"richm","id":23066,"avatar_url":"https://avatars.githubusercontent.com/u/23066?v=3","gravatar_id":"","url":"https://api.github.com/users/richm","html_url":"https://github.com/richm","followers_url":"https://api.github.com/users/richm/followers","following_url":"https://api.github.com/users/richm/following{/other_user}","gists_url":"https://api.github.com/users/richm/gists{/gist_id}","starred_url":"https://api.github.com/users/richm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/richm/subscriptions","organizations_url":"https://api.github.com/users/richm/orgs","repos_url":"https://api.github.com/users/richm/repos","events_url":"https://api.github.com/users/richm/events{/privacy}","received_events_url":"https://api.github.com/users/richm/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-05-19T23:04:26Z","updated_at":"2016-05-26T18:40:28Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/openshift/origin-aggregated-logging/pulls/142","html_url":"https://github.com/openshift/origin-aggregated-logging/pull/142","diff_url":"https://github.com/openshift/origin-aggregated-logging/pull/142.diff","patch_url":"https://github.com/openshift/origin-aggregated-logging/pull/142.patch"},"body":"This introduces a new environment variable: USE_JOURNAL.  If this is\r\nset to \"true\", fluentd will use the systemd-journal input plugin to\r\nread log messages from the journal instead of /var/log/messages*.\r\nThe immediate benefit is performance - reading log entries directly\r\nfrom the journal rather than having them go from the journal to\r\nrsyslog to /var/log/messages.  Another benefit is the microsecond\r\nprecision timestamps instead of seconds used by /var/log/messages.\r\nThere is a lot of metadata available from the journal which we can\r\nnow use.\r\nThis is not yet a complete replacement for the file based input.\r\n\r\n* Need to handle log throttling.  Might have to be done at the\r\n  journal level - there aren't any sort of throttling configuration\r\n  options in https://github.com/reevoo/fluent-plugin-systemd\r\n  journald (man journald.conf) has RateLimitInterval=, RateLimitBurst=\r\n  options.\r\n* Need to handle the case if user has configured persistent journal\r\n  logs (man journald.conf - Storage=) so may need to read from\r\n  /var/log/journal in addition to/instead of /run/log/journal\r\n* Need to handle historical logs.  The default configuration for\r\n  journald.conf on el7 is `Storage=auto` which means /run/log/journal\r\n  will be used for `volatile` storage unless the user has created\r\n  /var/log/journal.  `volatile` means not persistent, so the persistent\r\n  logs by default will be /var/log/messages*.  We need some way to grab\r\n  those logs, and de-dup them before storing in elasticsearch."},"comment":{"url":"https://api.github.com/repos/openshift/origin-aggregated-logging/issues/comments/221957975","html_url":"https://github.com/openshift/origin-aggregated-logging/pull/142#issuecomment-221957975","issue_url":"https://api.github.com/repos/openshift/origin-aggregated-logging/issues/142","id":221957975,"user":{"login":"openshift-bot","id":1779249,"avatar_url":"https://avatars.githubusercontent.com/u/1779249?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift-bot","html_url":"https://github.com/openshift-bot","followers_url":"https://api.github.com/users/openshift-bot/followers","following_url":"https://api.github.com/users/openshift-bot/following{/other_user}","gists_url":"https://api.github.com/users/openshift-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift-bot/subscriptions","organizations_url":"https://api.github.com/users/openshift-bot/orgs","repos_url":"https://api.github.com/users/openshift-bot/repos","events_url":"https://api.github.com/users/openshift-bot/events{/privacy}","received_events_url":"https://api.github.com/users/openshift-bot/received_events","type":"User","site_admin":false},"created_at":"2016-05-26T18:40:28Z","updated_at":"2016-05-26T18:40:28Z","body":"Aggregated Logging Test Results: FAILURE (https://ci.openshift.redhat.com/jenkins/job/test-origin-aggregated-logging/299/)"}}
{"actor":{"display_login":"openshift-bot"}}