vector: journald source fails to retrieve checkpoint

Software Versions

$ vector --version; journalctl --version
vector 0.4.0-dev
systemd 219
+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP \
+GCRYPT +GNUTLS +ACL +XZ +LZ4 -SECCOMP +BLKID +ELFUTILS +KMOD +IDN

Note that I’m running vector from the 0.5.0 RPM package, but the version is incorrectly reported. I’m running Vector on the latest (at time of filing issue) Amazon Linux 2 in EC2. The instance is pretty much vanilla except for Puppet and Vector.

Vector Config

data_dir = "/var/lib/vector"

[sources.in]
type = "journald"
units = ["puppet"]

[sinks.tempfile]
inputs = ["in"]
path = "/var/log/vector-puppet-%Y-%m-%d.log"
type = "file"

Issue

Hi,

There appears to be an issue with the journald source, but I’m hoping it’s just me missing something.

I’m expecting the above configuration to read from journald, filter out events from the puppet service, and write them to /var/log/vector-puppet-%Y-%m-%d.

However, what actually happens is Vector throws an error regarding the journald checkpointing.

ERROR source{name="in"}:journald-server: vector::sources::journald: Could not retrieve journald checkpoint. error=Cannot assign requested address (os error 99)

I believe this error originates here: https://github.com/timberio/vector/blob/c112c4ac7f45e69fea312e7691566a3f9e8e3066/src/sources/journald.rs#L221-L234

However, this is as far as I’ve got. Trying to follow the cursor code quickly disappears into the journald crate which calls out to some C code.

Might I be missing some required systemd configuration? I’ve scanned the documentation and read the vector.spec.toml, and I believe the above config should “just work”.

Thanks.

About this issue

  • Original URL
  • State: closed
  • Created 5 years ago
  • Comments: 26 (21 by maintainers)

Commits related to this issue

Most upvoted comments

I think the problem with thenix package is that it doesn’t have access to libsystemd.so, which is a run-time dependency for journald source. See https://github.com/timberio/vector/issues/1242#issuecomment-568513927 for details.

Sorry @dbhowell , I should have been clearer too, the reply was to @bruceg. 😃 Thanks for being another set of eyes on this!