[systemd-devel] Journal rotation and notifying users

[Lennart Poettering]

On Wed, 14.05.14 13:03, Colin Guthrie (gmane at colin.guthr.ie) wrote:

> Hiya,
> 
> I recently had a rather unfortunate crash on my home system. One of the
> disks failed and for some reason or another, it logged a lot of data.
> 
> As I don't have *that* much space for journal files (~800Mb) the logs
> rotated and when trying to diagnose the crash I was left with very
> little information. The fact that my journal logs started pretty much
> the same time as the server died initally made me suspicious that the
> files had been (maliciously or otherwise) deleted.
> 
> I wonder if it would be worthwhile to somehow store the last rotation
> metadata and show it at the beggining of the journalctl output which
> currently says e.g:
> 
> -- Logs begin at Tue 2014-05-13 20:09:01 BST, end at Wed 2014-05-14
> 13:00:05 BST. --
> 
> i.e. perhaps it should include details on when the last rotation occured
> and perhaps why?

But how would that information be any different from what is shown now?
I mean, everything that is older than the "Logs begin at" time has been
rotated away... Are you suggesting to simply change the text we show
there? "Logs rotated at"... or so?

Lennart

-- 
Lennart Poettering, Red Hat