[systemd-devel] Unbounded journal~ file accumulation

[Zbigniew Jędrzejewski-Szmek]

On Wed, Nov 26, 2014 at 09:59:12PM +0000, Moyer, Keith wrote:
> Running v215-6 via Debian jessie
> 
> In my situation, it is common to have unclean reboots.  On the subsequent boot, a system at ....journal~ file is created.  The problem is that these journal~ files do not trigger any cleanup with respect to SystemMaxUse.  If this occurs repeatedly, disk usage can go _way_ above SystemMaxUse.

There were some fixes in this area. 3bfd4e0c6341b0ef946d2198f089743fa99e0a97
might fix the unbounded size.

> * With my low SystemMaxUse, 4M is pretty large.  I see this minimum is hard-coded as JOURNAL_FILE_SIZE_MIN in the code.  Would I be inviting problems if I lowered this value to something like 512K? It was 64K until commit 253f59dff9.  Note: this query is secondary to the journal~ accumulation issue.

You can make the files smaller, but the space for various indexes which is created
with static size might have to be adjusted. I don't think the files that were created
were ever as small as 64KB, before 253f59dff9 journald would simply refuse to create
files when there wasn't enough disk space.

Playing around with SyncIntervalSec= might be a better option. With multiple small
journal files journalctl is going to get slow, which is not nice either.

Zbyszek