systemd-journald丢失内核日志，调整速率限制无效求助

Hey there, let's dig into that kernel log missing issue you're facing on your Arch Linux 4.14 LTS system. The systemd-journald: Missed 685 kernel messages error is usually a sign that either journald can't keep up with the flood of kernel logs, or there's a bottleneck in how logs are passed from the kernel to journald. Since you already tweaked rate limiting in journald.conf, let's go through some deeper fixes:

First, make sure journald is actually configured to read kernel messages properly, and that your rate limit values are set high enough:

• Open /etc/systemd/journald.conf with your favorite editor (like sudo nano /etc/systemd/journald.conf)
• Uncomment and adjust these parameters (remove the leading # if they're commented out):
  • ReadKMsg=yes – Ensures journald is actively pulling kernel logs
  • RateLimitBurst=20000 – Bump this way above the default 1000 (adjust based on how many logs you're generating)
  • RateLimitInterval=60s – Lengthen the interval to give journald more breathing room
• Save the file and restart journald with: sudo systemctl restart systemd-journald

Sometimes the kernel itself is throttling logs before they even reach journald. Let's adjust that:

• Temporary fix (resets on reboot):

  sudo sysctl -w kernel.printk_ratelimit=0
  sudo sysctl -w kernel.printk_ratelimit_burst=10000
  

• Permanent fix:
  Create a custom sysctl config file: sudo nano /etc/sysctl.d/99-kernel-log.conf
  Add these lines:

  kernel.printk_ratelimit=0
  kernel.printk_ratelimit_burst=10000
  

  Save and load the new settings: sudo sysctl --system

If the kernel is generating logs faster than its internal buffer can hold, older logs get overwritten before journald can read them. Let's expand that buffer:

• Edit your GRUB config: sudo nano /etc/default/grub
• Find the GRUB_CMDLINE_LINUX_DEFAULT line and add log_buf_len=16M (you can go up to 64M if needed). For example:

  GRUB_CMDLINE_LINUX_DEFAULT="quiet log_buf_len=16M"
  

• Update GRUB to apply the change: sudo grub-mkconfig -o /boot/grub/grub.cfg
• Reboot your system for the new buffer size to take effect

After making changes, let's confirm everything is working as expected:

• Check journald's status for errors: sudo systemctl status systemd-journald
• Compare kernel logs from dmesg and journald: Run dmesg -T and journalctl -k side by side to see if entries are missing
• Check journald's own logs for clues: journalctl -u systemd-journald – look for any warnings about log throttling or missed messages

Your current 4.14 LTS kernel is pretty old (it reached end-of-life in 2023). Newer LTS kernels (like 5.15 or 6.1) have fixes for various log handling bugs. To upgrade:

• Install the latest Arch LTS kernel: sudo pacman -S linux-lts
• Reboot and select the new kernel from GRUB

If none of these steps resolve the issue, you might want to check if specific hardware or kernel modules are spamming logs (use journalctl -k -f to watch live kernel logs and identify the culprit).

内容的提问来源于stack exchange，提问作者Ozbit