Hacker News Reader

Comment by gue5t | Hacker News Reader

1/2/3: No, it isn't that bad, but disable resolved and networkd, and coredumps, and prepare to hate journald with all your being because of how insanely mindbogglingly slow it is (owning a hard drive rather than an SSD is an unsupported configuration for journald). The init daemon is much better than init scripts; it isn't elegant, but it is at least declarative and efficient.

View on HN

Eh, journalctl isn't that bad on a spinning drive. The recent parts of the journal are usually in file cache, so if you use the limiters, like "journalctl --since today" or "journalctl -e"; or view in reverse order "journalctl -r" then things are speedy.

One thing I've seen systemd newbies do that I have to shake my head at is "journalctl | grep sshd" and that's entirely the wrong way to do it.

I don't have enough RAM that journal is usually in cache (just anecdotally, it seems to always be slow the first time in a session that I run it). Nonetheless, I can access most uncached contents of my disk much faster than this:

    $ time journalctl -r | head -n 50
    (...)
    journalctl -r  0,01s user 0,04s system 0% cpu 5,289 total
    head -n 50  0,00s user 0,00s system 0% cpu 5,287 total

If your lifestyle involves embracing the capitalist consumption treadmill of buying new hardware every couple of years, systemd-journald may be for you. Otherwise prepare to be told to throw away perfectly good computer hardware because Lennart is too lazy to design software that can cope gracefully with disk latency.

"journalctl -r" is loading all the available logs on your system. If you only want the most recent 50 lines, use "journalctl -r -n 50".

It certainly isn't; it's killed by SIGPIPE after printing 50 lines. If I wanted to wait for the entire system log to read off of disk I'd be sitting for minutes.

"journalctl -r -n 50" takes 5.4 seconds as of a test just now from (this time, artificially) cold cache.

Considering that the concept is breaking the Unix tradition of a tool having a single purpose and utilizing this fantastic feature we call "pipes"... journalctl is the wrong way to do it.

Reply on news.ycombinator.com