[plugins] Speedup journal collection

Instead of generating all the logs and tailing the last 100M,
we get the first 100M of 'journalctl --reverse' that we then
reverse again using tac_logs().

On journalctl timeout we now get the most recents logs
where previously we were getting some random old logs.

During collection, logs are now buffered on disk, so we use 2xsizelimit.
Previously buffering was in RAM (also 2xsizelimit).

On my test server, logs plugin runtime goes from 34s to 9.5s.

Signed-off-by: Etienne Champetier <[email protected]>

sos/report/plugins/__init__.py

@@ -3088,8 +3088,15 @@ def add_journal(self, units=None, boot=None, since=None, until=None,
         if output:
             journal_cmd += output_opt % output
 
+        fname = journal_cmd
+        tac = False
+        if log_size > 0:
+            journal_cmd = f"{journal_cmd} --reverse"
+            tac = True
+
         self._log_debug(f"collecting journal: {journal_cmd}")
         self._add_cmd_output(cmd=journal_cmd, timeout=timeout,
+                             tac=tac, to_file=True, suggest_filename=fname,
                              sizelimit=log_size, pred=pred, tags=tags,
                              priority=priority)
 

tests/report_tests/plugin_tests/defaults.py

@@ -36,7 +36,7 @@ def test_journal_collected(self):
         _m = self.get_plugin_manifest('cups')
         ent = None
         for cmd in _m['commands']:
-            if cmd['exec'] == 'journalctl --no-pager  --unit cups':
+            if cmd['exec'] == 'journalctl --no-pager  --unit cups --reverse':
                 ent = cmd
         assert ent, "No manifest entry for journalctl cups"