Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1413413 - Journald reports "journal uses an unsupported feature" due to file corruption.
Summary: Journald reports "journal uses an unsupported feature" due to file corruption.
Keywords:
Status: CLOSED DUPLICATE of bug 1404406
Alias: None
Product: Fedora
Classification: Fedora
Component: systemd
Version: 25
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: systemd-maint
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-01-15 22:11 UTC by Knut Lars Ulendorf
Modified: 2017-01-16 13:44 UTC (History)
11 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-01-16 07:09:01 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)

Description Knut Lars Ulendorf 2017-01-15 22:11:13 UTC 
Description of problem:

One of the journal files on my f25 box has become corrupted and jc refuses to open it.
restarting journald opened a new file and continued logging, but the file contents were
still unavailable.

Version-Release number of selected component (if applicable):

This occured within 12 hours after cron-yum upgraded to 
systemd.x86_64 231-11.fc25  


Additional info:

I looked up the on-disk file format spec and opened the corrupted file in a hex editor,
the field Header.incompatible_flags had the value 2, which is illegal, according to the spec
at https://www.freedesktop.org/wiki/Software/systemd/journal-files/
the only flag currently defined for that field has the value 1. Changing the value of the field 
from 2 to 1 made the file readable again.

It seems incredibly unlikely that a random corruption (bits flip, it happens) would be 
so surgically precise in rendering an entire file unreadable. This occurred shortly after a systemd
upgrade, but that might be a coincidence. I may also have been hacked, in which case this is a cute, 
though not very stealthy, trick.

Putting this here as a notice, just in case similar reports begin to surface which might show this is 
more than a freak accident.
Comment 1 Jan Synacek 2017-01-16 07:09:01 UTC 
This was very likely caused by the new build. The original journal was built against and used lz4 compression, but the new build didn't. Personally, I hate that error message as it is pretty useless, but I'm not sure if it can be easily fixed.

*** This bug has been marked as a duplicate of bug 1404406 ***
Comment 2 Knut Lars Ulendorf 2017-01-16 13:44:21 UTC 
Looks right, only if the compression support was left out of the build, how in the hell could
journald read the lz4 compressed hournal file once I flipped the incompatible bit to call it xz compressed? curious.
Either that build was very strange or you have a redundant dep somewhere.

Anyway, that flag was added in 2014:
https://github.com/systemd/systemd/commit/d89c8fdf48c7bad5816b9f2e77e8361721f22517

And the docs at:
https://www.freedesktop.org/wiki/Software/systemd/journal-files/

were never updated. So it goes.
Note You need to log in before you can comment on or make changes to this bug.