[systemd-devel] Force rotating the journal?

[Lennart Poettering]

On Wed, 28.11.12 10:14, Dave Reisner (d at falconindy.com) wrote:

> I'm not sure when it happened, but rotation used to be "off" by a
> difference of whatever the MaxFileSize option was, e.g. if you had a
> 200M MaxUse and a 50M MaxFileSize, then you'd see usage up to 250M
> before old logs were expired. I reported this, and there was a TODO item
> added.

Yeah, the TODO list item is actually really hard to fix, since we have
multiple journal files fro writing open: i.e. one for the each user plus
the system one. If each file can grow to N bytes in size, and we should
enforce a total of M, then it's not sufficient to delete files until we
reach the limit of M-N, since if we grow multiple files then we might
still easily hit the M limit without noticing... Not sure what we can do
to properly fix this so that we can guarantee that SystemMaxUse= is
actually really the maximum use, and that we never ever write a single
byte more than this.

> 
> At least with 196 (maybe earlier), this no longer holds true any more.
> The journal appears to just ignore settings in journald.conf and grow
> without bound:
> 
> $ grep -E 'SystemMax(Use|FileSize)' /etc/systemd/journald.conf
> SystemMaxUse=200M
> SystemMaxFileSize=50M
> 
> $ journalctl --disk-usage
> Journals take up 436.0M on disk.
> 
> Forcing rotation opens a new file, but old logs are not expired, leaving
> disk usage way above the set maximum. There also seems to be a recent
> issue with more uncleanly closed journal files showing up. Unless I
> umount my root at shutdown (with initramfs magic), I can very reliably
> expect that the journal will mark the last used file as unclean on the
> next bootup. My suspicion is that the journal doesn't take into account
> these uncleanly closed files when calculating disk usage for rotation,
> but I've not had time to confirm that.

Umm. Sounds like a bug, could you file this on fdo bz, plz?

Lennart

-- 
Lennart Poettering - Red Hat, Inc.