On Feb 25, 2014, at 1:03 PM, Neal Becker <ndbecker2(a)gmail.com> wrote:
>
Here's what might be a big clue:
Just after the hunk of prehistoric lines, when we get back to Feb, the 1st thing
I see is:
Feb 25 12:07:55 nbecker7 rsyslogd-2177: imjournal: begin to drop messages due to
rate-limiting
Feb 25 12:18:40 nbecker7 rsyslogd-2177: imjournal: 145977 messages lost due to
rate-limiting
Seems very suspicious to me.
My understanding is that everything goes into the journal. And rsyslogd directly reads
either journal logs or streams (I forget which). So if you can compare journalctl and
messages for these times, maybe the journal has more information about what was submitting
so many messages.
journalctl doesn't seem to show time warps.
That is a good sign. Also journald will report if logs are corrupt. You can also do:
# journalctl --verify
Hmm, now I just did a verify and I get some "File corruption detected" messages,
yet no reports of corruption in the log reported by systemd-journald itself. That's
curious… And I'm also using Btrfs. I didi previously find a journal corruption issue
some months ago with Btrfs but that's long ago fixed. This could be a journal
inconsistency, or could be due to crashes and not the file system.
Old thread:
http://unix.stackexchange.com/questions/86206/journalctl-verify-reports-c...
Chris Murphy