Handle transient systemd state flag changes. (#21695)
When systemd-journal temporarily sets a journal file's header state to something other than STATE_ONLINE (e.g., during flush/sync operations), the file indexer would incorrectly mark the file as offline/archived. This caused the cache entry to be considered "always fresh" and never re-indexed, resulting in the file being excluded from queries when its bounded time range didn't overlap with the current query time. The fix checks both the journal header state AND the file's status from its filename. If the filename indicates an active file (no @ suffix), it's treated as online regardless of the transient header state. The otel-plugin implementation always uses "archived" filenames and does not suffer from this issue.
vkalintiris committed
Feb 2, 2026 at 19:57 UTC
5638b80d28bf0cfaa90f6391b332cb58ead20efc
1 file changed
+19
-2
src/crates/journal-index/src/file_indexer.rs
+19
-2
@@ -98,8 +98,25 @@ impl FileIndexer {
98
// Capture indexing timestamp
99
let indexed_at = Seconds::now();
100
101
- // Capture whether the file was online when indexed
102
- let was_online = journal_file.journal_header_ref().state == 1;
101
+ // Capture whether the file was online when indexed.
102
+ //
103
+ // A file is considered online if:
104
+ // 1. The journal header state is 1 (STATE_ONLINE), OR
105
+ // 2. The file is an "Active" file by filename (e.g., system.journal
106
+ // without the @seqnum_id-head_seqnum-head_realtime suffix)
107
+ //
108
+ // We check both conditions because systemd-journal may temporarily set
109
+ // `state != 1` on active journal files (e.g., during flush operations).
110
+ // If we only checked the header state, we might incorrectly mark an
111
+ // active file as offline/archived, causing its cache entry to be
112
+ // considered "always fresh" and never re-indexed. This would result
113
+ // in the file being excluded from queries for current time ranges
114
+ // because its bounded time range (from when it was indexed) doesn't
115
+ // overlap with the query range.
116
+ //
117
+ // The otel-plugin does not suffer from this issue because it always
118
+ // uses "archived", instead of "active", filenames.
119
+ let was_online = journal_file.journal_header_ref().state == 1 || file.is_active();
120
121
let field_map = journal_file.load_fields()?;
122