[systemd-devel] Journal rotation and notifying users

[Colin Guthrie]

Hiya,

I recently had a rather unfortunate crash on my home system. One of the
disks failed and for some reason or another, it logged a lot of data.

As I don't have *that* much space for journal files (~800Mb) the logs
rotated and when trying to diagnose the crash I was left with very
little information. The fact that my journal logs started pretty much
the same time as the server died initally made me suspicious that the
files had been (maliciously or otherwise) deleted.

I wonder if it would be worthwhile to somehow store the last rotation
metadata and show it at the beggining of the journalctl output which
currently says e.g:

-- Logs begin at Tue 2014-05-13 20:09:01 BST, end at Wed 2014-05-14
13:00:05 BST. --

i.e. perhaps it should include details on when the last rotation occured
and perhaps why?

Or maybe somehow store independently something about the rotations that
occur so we can see periods of extreme logging?

I'm not really sure what would be possible, but the situation didn't
feel great to me when I experienced it, although the fact it didn't fill
up my disk was very well received :)

Any thoughts?


Col





-- 

Colin Guthrie
gmane(at)colin.guthr.ie
http://colin.guthr.ie/

Day Job:
  Tribalogic Limited http://www.tribalogic.net/
Open Source:
  Mageia Contributor http://www.mageia.org/
  PulseAudio Hacker http://www.pulseaudio.org/
  Trac Hacker http://trac.edgewall.org/