The journald vacuum gotcha

If you read the systemd journal with a saved cursor, here is a small trap: when the journal is vacuumed, your cursor can point at an entry that no longer exists.

journalctl --vacuum-size=200M
# a reader that resumes from an old cursor now gets
# "Failed to seek to cursor: Cannot assign requested address"

Most readers then fall back to either the head or the tail of the journal. Head means re-sending days of logs; tail means silently skipping whatever arrived in between.

What I do now

Store the realtime timestamp alongside the cursor. If seeking to the cursor fails, seek to the timestamp instead and accept a few duplicates. Duplicates are annoying; gaps are worse.

Not exciting, but it cost me an afternoon, so here it is.