Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes for reading journald logs #38859

wants to merge 9 commits into
base: master


None yet
4 participants
Copy link

commented Mar 13, 2019

This series is an attempt to straighten out journald log reading (i.e using docker logs for a container with journald log driver. In particular, it should fix at least two issues:

  • #27343 (stale opened fd when the journal is frequently rotated and/or the reader is following for a long time);
  • docker/for-linux#575 (docker logs --follow not exiting once a container is gone).

In addition, it should improve code readability and fix some minor bugs, like

  • docker logs --tail=0 not working properly (which seems to be useless until one adds --follow);
  • docker logs --since off-by-one record wrt timestamps;
  • (potential?) goroutine leak when a following reader disappears early (same as #37391 but for journald).

Finally, this PR reduces the code size a bit:

2 files changed, 108 insertions(+), 159 deletions(-)

Testing notes

Note that current CI does not test journald log driver in any way (which might be the reason why it's in so unfortunate state). Therefore, I have tested the results manually and also by running all TestLogs* tests from the integration-cli/ (the result is, a number of test case failures decreased substiantially).

A potential followup to this PR would be to move the above mentioned tests to integration, and make sure CI runs those with log drivers other than the default (json-file).

Known bugs

NOTE: These are not newly introduced bugs; they were there before and are not fixed by this PR

  • --follow is impossible to implement entirely correct due to async nature of journald log writing; therefore it's possible that it would end up earlier than all the container logs are shown. The possibility of this depends on the system load (mostly I/O) as well as the value of waitTimeout in followJournal().

  • because of the above, --follow does not exits immediately, there's a waiting period which amounts to about a second;

  • sometimes reading container logs right after it has finished (such as in docker wait $ID && docker logs $ID) does not produce any output; the reason is the same async nature of the journald writing.

  • In some corner cases \n is lost from the logs; here's a repro:

$ ID=$(docker run -d busybox sh -c 'for i in $(seq 1 32767); do echo -n = >> a.a; done; echo >> a.a; cat a.a'); docker wait $ID; sleep 1; docker logs $ID | od -c
0000000   =   =   =   =   =   =   =   =   =   =   =   =   =   =   =   =
0077760   =   =   =   =   =   =   =   =   =   =   =   =   =   =   =  \n

$ ID=$(docker run -d busybox sh -c 'for i in $(seq 1 32768); do echo -n = >> a.a; done; echo >> a.a; cat a.a'); docker wait $ID; sleep 1; docker logs $ID | od -c
0000000   =   =   =   =   =   =   =   =   =   =   =   =   =   =   =   =

$ ID=$(docker run -d busybox sh -c 'for i in $(seq 1 32769); do echo -n = >> a.a; done; echo >> a.a; cat a.a'); docker wait $ID; sleep 1; docker logs $ID | od -c
0000000   =   =   =   =   =   =   =   =   =   =   =   =   =   =   =   =
0100000   =  \n

Note in the second run (the one with seq 1 32768) the \n in the end is lost. There is the same bug in local driver for seq 1 16384 or more, and I guess it's not super critical.

This work is partially based on prior PR #36254 by @nalind

A picture of a cute animal

image source:

nalind and others added some commits Feb 7, 2018

Small journal cleanup
Clean up a deferred function call in the journal reading logic.

Signed-off-by: Nalin Dahyabhai <>
journald/read: simplify code
Minor code simplification.

Signed-off-by: Kir Kolyshkin <>
journald/read: simplify walking backwards
In case Tail=N parameter is requested, we need to show N lines.
It does not make sense to walk backwards one by one if we can
do it at once. Now, if Since=T is also provided, make sure we
haven't jumped too far (before T), and if we did, move forward.

The primary motivation for this was to make the code simpler.

This also fixes a tiny bug in the "since" implementation.

Before this commit:
> $ docker logs -t --tail=6000 --since="2019-03-10T03:54:25.00" $ID | head
> 2019-03-10T03:54:24.999821000Z 95981

> $ docker logs -t --tail=6000 --since="2019-03-10T03:54:25.00" $ID | head
> 2019-03-10T03:54:25.000013000Z 95982

Signed-off-by: Kir Kolyshkin <>
journald/read: avoid being blocked on send
In case the LogConsumer is gone, the code that sends the message can
stuck forever. Wrap the code in select case, as all other loggers do.

Signed-off-by: Kir Kolyshkin <>
Call sd_journal_get_fd() earlier, only if needed
1. The journald client library initializes inotify watch(es)
during the first call to sd_journal_get_fd(), and it make sense
to open it earlier in order to not lose any journal file rotation

2. It only makes sense to call this if we're going to use it
later on -- so add a check for config.Follow.

3. Remove the redundant call to sd_journal_get_fd().

NOTE that any subsequent calls to sd_journal_get_fd() return
the same file descriptor, so there's no real need to save it
for later use in wait_for_data_cancelable().

Based on earlier patch by Nalin Dahyabhai <>.

Signed-off-by: Kir Kolyshkin <>

This comment has been minimized.

Copy link

commented Mar 13, 2019

Codecov Report

❗️ No coverage uploaded for pull request base (master@42ad354). Click here to learn what that means.
The diff coverage is n/a.

@@            Coverage Diff            @@
##             master   #38859   +/-   ##
  Coverage          ?   36.45%           
  Files             ?      613           
  Lines             ?    45814           
  Branches          ?        0           
  Hits              ?    16702           
  Misses            ?    26830           
  Partials          ?     2282

kolyshkin added some commits Mar 12, 2019

journald/read: simplify/fix followJournal()
TL;DR: simplify the code, fix --follow hanging indefinitely

Do the following to simplify the followJournal() code:

1. Use Go-native select instead of C-native polling.

2. Use Watch{Producer,Consumer}Gone(), eliminating the need
to have journald.closed variable, and an extra goroutine.

3. Use sd_journal_wait(). In the words of its own man page:

> A synchronous alternative for using sd_journal_get_fd(),
> sd_journal_get_events(), sd_journal_get_timeout() and
> sd_journal_process() is sd_journal_wait().

Unfortunately, the logic is still not as simple as it
could be; the reason being, once the container has exited,
journald might still be writing some logs from its internal
buffers onto journal file(s), and there is no way to
figure out whether it's done so we are guaranteed to
read all of it back. This bug can be reproduced with
something like

> $ ID=$(docker run -d busybox seq 1 150000); docker logs --follow $ID
> ...
> 128123
> $

(The last expected output line should be `150000`).

To avoid exiting from followJournal() early, add the
following logic: once the container is gone, keep trying
to drain the journal until there's no new data for at
least `waitTimeout` time period.

Should fix docker/for-linux#575

Signed-off-by: Kir Kolyshkin <>
journald/read: avoid piling up open files
If we take a long time to process log messages, and during that time
journal file rotation occurs, the journald client library will keep
those rotated files open until sd_journal_process() is called.

By periodically calling sd_journal_process() during the processing
loop we shrink the window of time a client instance has open file
descriptors for rotated (deleted) journal files.

This code is modelled after that of journalctl [1]; the above explanation
as well as the value of 1024 is taken from there.

[v2: fix CErr() argument]

Signed-off-by: Kir Kolyshkin <>
journald: fix for --tail 0
From the first glance, `docker logs --tail 0` does not make sense,
as it is supposed to produce no output, but `tail -n 0` from GNU
coreutils is working like that, plus there is even a test case
(`TestLogsTail` in integration-cli/docker_cli_logs_test.go).

Now, something like `docker logs --follow --tail 0` makes total
sense, so let's make it work.

(NOTE if --tail is not used, config.Tail is set to -1)

Signed-off-by: Kir Kolyshkin <>
journald/read: fix/unify errors
1. Use "in-place" variables for if statements to limit their scope to
   the respectful `if` block.

2. Report the error returned from sd_journal_* by using CErr().

3. Use errors.New() instead of fmt.Errorf().

Signed-off-by: Kir Kolyshkin <>

@kolyshkin kolyshkin force-pushed the kolyshkin:journald branch from e1c82f0 to 68f3dca Mar 13, 2019


This comment has been minimized.

Copy link
Contributor Author

commented Mar 14, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.