Support systemd without files

[roidelapluie]

Currently promtail requires systemd to flush its files to disk.

As fluentbit is doing it, it is possible to read journald without requiring it to flush on disk.

[rfratto]

Could you provide any more information that might help me figure out what needs to be changed? I took a look at the fluentbit code and the only obvious difference I could find is that Promtail always calls sd_journal_open_directory, while fluentbit only calls it when an explicit path is provided.

[roidelapluie]

I came to the same conclusion as you.

https://www.freedesktop.org/software/systemd/man/sd_journal_open.html

sd_journal_open()
SD_JOURNAL_RUNTIME_ONLY makes sure only volatile journal files will be opened, excluding those which are stored on persistent storage.

It means that sd_journal_open can read journald volatiles logs (not persisted to disk)

[roidelapluie]

One good reason to support this is that it is Red Hat Entreprise Linux 7 default.

[rfratto]

Gotcha, thanks for the help. Looking into it more, it's not necessarily the flags that you pass (fluentbit hard-coded SD_JOURNAL_LOCAL_ONLY), but it's that when sd_journal_open_directory is called, the volatile logs aren't read.

See add_search_paths for how systemd reads volatile logs, and how sd_journal_open_directory won't call that function if a path is provided.

I'll work on a PR for this tomorrow. Thanks for reporting!

[roidelapluie]

Yes I pasted the flag because it mentions volatile logs, we don't need it.

Also in RHEL7 there is no /var/log/journal by default so promtail-journal does not work out of the box here.

[roidelapluie]

Ok, so in my case I could use /run/log/journal to read those logs with loki.

[roidelapluie]

for the record:

- job_name: journal
  journal:
    path: /run/log/journal
    labels:
      job: journal

works