From 55c308c90d39770e761a1a6f2ebe3538dc7bd22d Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 25 May 2017 13:10:53 -0700
Subject: [PATCH] Save less journal data

The journal data is relatively massive and its hurting us on the logs
server. Update to only grabbing devstack related journal data to see if
this is smaller in a useable way.

Change-Id: I97012759fe01566a2f916bff8a120154d2dbc635
---
 functions.sh | 35 +++++++++++++++--------------------
 1 file changed, 15 insertions(+), 20 deletions(-)

diff --git a/functions.sh b/functions.sh
index f1acac3d..4414aa30 100644
--- a/functions.sh
+++ b/functions.sh
@@ -642,23 +642,6 @@ function cleanup_host {
     # Sleep to give services a chance to flush their log buffers.
     sleep 2
 
-    # No matter what, archive logs and config files
-    if which journalctl ; then
-        # The journal contains everything running under systemd, we'll
-        # build an old school version of the syslog with just the
-        # kernel and sudo messages.
-        sudo journalctl \
-             -t kernel \
-             -t sudo \
-             --no-pager \
-             --since="$(cat $BASE/log-start-timestamp.txt)" \
-            | sudo tee $BASE/logs/syslog.txt > /dev/null
-    else
-        # assume rsyslog
-        save_file /var/log/syslog
-        save_file /var/log/kern.log
-    fi
-
     # apache logs; including wsgi stuff like horizon, keystone, etc.
     if uses_debs; then
         local apache_logs=/var/log/apache2
@@ -799,10 +782,22 @@ function cleanup_host {
         done
         # export the journal in native format to make it downloadable
         # for later searching, makes a class of debugging much
-        # easier. This intentionally includes everything, not just
-        # devstack services.
-        sudo journalctl -o export | \
+        # easier.
+        sudo journalctl -u 'devstack@*' -o export | \
             $jremote -o $BASE/logs/devstack.journal -
+        # The journal contains everything running under systemd, we'll
+        # build an old school version of the syslog with just the
+        # kernel and sudo messages.
+        sudo journalctl \
+             -t kernel \
+             -t sudo \
+             --no-pager \
+             --since="$(cat $BASE/log-start-timestamp.txt)" \
+            | sudo tee $BASE/logs/syslog.txt > /dev/null
+    else
+        # assume rsyslog
+        save_file /var/log/syslog
+        save_file /var/log/kern.log
     fi
 
     # Copy failure files if they exist