[systemd-devel] journal like cyclic buffer?

[Lennart Poettering]

On Sun, 27.10.13 18:52, Warpme (warpme at o2.pl) wrote:

> Hi *
> 
> Is there possibility to configure systemd journal to behave like
> cyclic buffer with given buffer size?

This is how things already behave. Simply use SystemMaxUse= in
journald.conf to set the maximum buffer size. With SystemMaxFileSize=
you can set the granularity in which we rotate the ring buffer.

> Currently I see only rotation mechanism. Issue with rotation is that
> just after rotation, journal is almost empty and user don't have
> access to old log data.

No, this is not how this works. journalctl (actually libsystemd-journal)
will transparently merge all available journal files into a single
continious stream regardless whether the journal files are marked as
"archived" or are live. Rotation hence has no effect on what you
see. It's little more than an internal scheme how things are stored on
disk.

> I have already many situations where interesting me log entries were
> unavailable (via journalctl) due rotated journal files.

This can only really happen if the granularity used for rotation is too
small. Use SystemMaxFileSize= to influence this setting.

Lennart

-- 
Lennart Poettering - Red Hat, Inc.