On Tue, Jul 16, 2013 at 01:25:54PM +0200, Lennart Poettering wrote:
I am pretty sure that is just a misunderstanding. Note that journald (i.e. the *server* side) will immediately move away (i.e. "rotate") all journal files that it finds have not been set to "offline" when it starts up before writing, in order to make sure that it will not interfere with journal files that are incompletely written (possibly further corrupting them). However journalctl (i.e. the *client* side) will still access the file, and interleave it with all others it finds, and show it to you as far as that's possible.
So yeah, you could say that journald will 'ignore' the file. But journalctl won't, it will show them to you. And that's *good* that way. That's how it *should* be.
Will journalctl also mention that there is a broken jorunal file? Does it support to "fsck" the journal or to show the not properly referenced data to the admin?
Regards Till