【24.03】systemctl-journal设置Storage=volatile,将/run目录占满后，/run/log/下无system.journal文件

**【24.03】systemctl-journal设置Storage=volatile,将/run目录占满后，/run/log/下无system.journal文件**

**一、缺陷信息**

**内核信息：**
![输入图片说明](https://foruda.gitee.com/images/1713440135935850801/44c4a08c_5045644.png "屏幕截图")
**缺陷归属组件：**
systemd
**缺陷归属的版本：**
![输入图片说明](https://foruda.gitee.com/images/1713440144645654163/d3f74f0d_5045644.png "屏幕截图")
**缺陷简述：**
【24.03】systemctl-journal设置Storage=volatile,将/run目录占满后，/run/log/下无system.journal文件
**【环境信息】**
硬件信息
虚拟机
软件信息
![输入图片说明](https://foruda.gitee.com/images/1713440160220055146/e79f4e0e_5045644.png "屏幕截图")
网络信息
- 如果有特殊组网，请提供网络拓扑信息

**【问题复现步骤】**，请描述具体的操作步骤
```
cp -ar /etc/systemd/journald.conf /etc/systemd/journald.conf.bak
sed -i "s/.*RateLimitIntervalSec.*/RateLimitIntervalSec=0/g" /etc/systemd/journald.conf
sed -i "s/.*RateLimitBurst.*/RateLimitBurst=0/g" /etc/systemd/journald.conf
sed -i "s/.*Storage=.*/Storage=volatile/g" /etc/systemd/journald.conf
rm -rf /var/log/journal
systemctl daemon-reload
systemctl  restart systemd-journald
run_size=$(df | grep "/run$" | awk '{print $4}')
fallocate -l "${run_size}K" /run/log/tmp_test
for _ in {1..50000}; do
    # 实测，将/run占满后，需再写入6000次左右日志，/run才真正的打满
    logger -t "This is Test" -p local0.warning "hello world"
done
journal_path=$(find /run/log -name "system.journal" | sed -n 1p)
```

**【实际结果】**，请描述出问题的结果和影响
journal_path=空
/run/log/下无system.journal文件
[图片上传中…(image-lpp5Uud20ZSU8DkbKpk5)]

**【其他相关附件信息】**
比如系统message日志/组件日志、dump信息、图片等
![输入图片说明](https://foruda.gitee.com/images/1713440434555827756/85c8b262_5045644.png "屏幕截图")
**缺陷详情参考链接：**

**缺陷分析指导链接：**

### 【分析定位】
- systemd社区相关PR和补丁：https://github.com/systemd/systemd/pull/22808
https://github.com/systemd/systemd/commit/4bb37be07b3ba96949266c5d95a0222e91a695ee （主要是该补丁，删除了system.journal）

- 从代码上看，这个文件本来是一个损坏的不能使用的文件：
    journal_file_open_reliably -> journal_file_open -> openat_report_new（创建文件） -> journal_file_init_header(空间不足会失败，最终是个损坏的文件) -> unlink(fname) 。
    ```
            if (newly_created) {
                    (void) journal_file_warn_btrfs(f);
    
                    /* Let's attach the creation time to the journal file, so that the vacuuming code knows the age of this
                     * file even if the file might end up corrupted one day... Ideally we'd just use the creation time many
                     * file systems maintain for each file, but the API to query this is very new, hence let's emulate this
                     * via extended attributes. If extended attributes are not supported we'll just skip this, and rely
                     * solely on mtime/atime/ctime of the file. */
                    (void) fd_setcrtime(f->fd, 0);
    
                    r = journal_file_init_header(f, file_flags, template);
                    if (r < 0)
                            goto fail;
    
                    r = journal_file_fstat(f);
                    if (r < 0)
                            goto fail;
            }
    fail:
            if (f->cache_fd && mmap_cache_fd_got_sigbus(f->cache_fd))
                    r = -EIO;
    
            (void) journal_file_close(f);
    
            if (newly_created && fd < 0)
                    (void) unlink(fname);
    
            return r;
    ···
    
    ```
- 从提交上看：原来的逻辑会一直创建损坏的文件。
    ```
    When opening the system journal, journal_file_open(), called by
    managed_journal_file_open_reliably(), finds the persistent system journal left
    previously and assumes that it was uncleanly closed and considers it as
    corrupted. The error is reported to managed_journal_file_open_reliably(), which
    backs the file up and attempts to create a new system file, which fails and
    leaves a corrupted system file again.
    
    Since this is done for each message received by journald, /var/log/message can
    be filled with backup files pretty quickly.
    
    To prevent this, the patch makes sure to delete the newly created file in case
    of error.
    ```
### 结论：system.journal在损坏时不应该被保留在journal目录下。

src-openEuler/systemd

内容风险标识

评论 (2)

src-openEuler/systemd .gitee-modal { width: 500px !important; }

内容风险标识