vector docker journald source broken

[nivekuil]

A note for the community

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Problem

Using vector's debian docker image, the journald source has been broken for recent systemd versions, spamming these logs

2023-03-02T17:09:31.620240Z  INFO source{component_kind="source" component_id=journald component_type=journald component_name=journald}: vector::sources::journald: Starting journalctl.
Journal file /var/log/journal/2926f5c891774760a3e59d508db7f46c/user-1000.journal uses an unsupported feature, ignoring file.
Use SYSTEMD_LOG_LEVEL=debug journalctl --file=/var/log/journal/2926f5c891774760a3e59d508db7f46c/user-1000.journal to see the details.
Data from the specified boot (+0) is not available: No such boot ID in journal
2023-03-02T17:09:31.624722Z  WARN source{component_kind="source" component_id=journald component_type=journald component_name=journald}: vector::sources::journald: Journalctl process stopped.

It may have to do with this change https://github.com/systemd/systemd/blob/main/NEWS#L1088

Does the journald binary in the image need to be updated?

debug output from the journal file, not sure if we would see the incompatible header in there

Journal effective settings seal=no keyed_hash=yes compress=yes compress_threshold_bytes=8B
File /var/log/journal/2926f5c891774760a3e59d508db7f46c/user-1000.journal added.
Journal filter: none
Successfully forked off '(pager)' as PID 195981.
Skipping PR_SET_MM, as we don't have privileges.
Found cgroup2 on /sys/fs/cgroup/, full unified hierarchy
Failed to execute 'pager', will try 'less' next: No such file or directory
Pager executable is "less", options "FRSXMK", quit_on_interrupt: yes

Configuration

No response

Version

vector 0.27.1 (x86_64-unknown-linux-gnu 19a51f2 2023-02-22)

Debug Output

No response

Example Data

No response

Additional Context

No response

References

No response

[neuronull]

Hi @nivekuil using the docker image timberio/vector:0.27.1-debian , I was not able to reproduce this.

Would you mind providing some more details to facilitate reproducing the issue, such as your configuration, any other relevant information.

Thanks

[jszwedko]

Closing due to lack of response. Please leave a comment if you experience this issue!

[kashalls]

Currently experiencing this issue as of right now.

Running Debian 12 (Bookwork), It is reproducible over 6 of the same machine.

2023-07-21T11:49:05.012551Z  INFO source{component_kind="source" component_id=journald_source component_type=journald component_name=journald_source}: vector::sources::journald: Starting journalctl.

Journal file /var/log/journal/b71a06251086426c8480fbb855cd5d82/user-1000@0175cf9623a441888c897502e89b8cd3-00000000000279f1-0005ffdaed32bded.journal uses an unsupported feature, ignoring file.

Use SYSTEMD_LOG_LEVEL=debug journalctl --file=/var/log/journal/b71a06251086426c8480fbb855cd5d82/user-1000@0175cf9623a441888c897502e89b8cd3-00000000000279f1-0005ffdaed32bded.journal to see the details.

Data from the specified boot (+0) is not available: No such boot ID in journal

2023-07-21T11:49:05.026779Z  WARN source{component_kind="source" component_id=journald_source component_type=journald component_name=journald_source}: vector::sources::journald: Journalctl process stopped.

It looks like updating the debian base image used in the Dockerfile to bookworm-slim solves this issue for Debian 12 users.
I built a container using vector v0.31.0 at https://github.com/users/Kashalls/packages/container/package/vector-but-its-using-bookwork and this error message goes away.

[jszwedko]

Thanks for the prompt @kashalls ! I opened a PR to update: #18057