With b/120686750, we're using journalctl for CrOS logging now. It seems like this is in parallel with old mechanisms, but it's already causing problems [1], so it needs to be debugged on the test server now.

The binary format that systemd-journald uses don't seem to be compatible with the log trimming that autotest does. See, for instance:

https://stainless.corp.google.com/browse/chromeos-autotest-results/276858920-chromeos-test/

The systemd.journal file:

https://storage.cloud.google.com/chromeos-autotest-results/276858920-chromeos-test/chromeos4-row9-rack10-host7/logging_UserCrash/sysinfo/var/log/journal/00000000000000000000000000000001/system.journal

starts with:

!!! This file is trimmed !!!
Original size: 33554432 bytes

and then a bunch of binary garbage which may or may not be readable. (I tried trimming the file a little and passing it to journalctl, but I still couldn't read it.)

When I try journal.gz, it seems better when I decompress it, but I still get errors when I try to get journalctl to read it:

$ journalctl --file 276858920-chromeos-test_chromeos4-row9-rack10-host7_logging_UserCrash_sysinfo_journal
Failed to open files: Bad message


Am I doing things wrong? I know plenty of people have complained about journald's non-text formats, but I'd hope there was some kind of robustness to this, and I just haven't figured it out.

If journald/journalctl can't handle this kind of trimming, then that sounds like it's going to conflict with the test/lab policies for trying to shrink logs.


[1] e.g.,  https://crbug.com/921679