[systemd-devel] Journal, rotation and loglevels

[Lennart Poettering]

On Thu, 23.10.14 17:19, D.S. Ljungmark (spider at aanstoot.se) wrote:

> 
> 
> On 23/10/14 16:50, Lennart Poettering wrote:
> > On Thu, 23.10.14 15:27, D.S. Ljungmark (spider at aanstoot.se) wrote:
> > 
> >> Hi,
> >>   we have a few services that are spamming a fair bit on DEBUG level of
> >> log output. In syslog, we'd separate the DEBUG logs from the main log,
> >> and set the rotation of DEBUG+ to be ~24 hours, while keeping INFO and
> >> above for ~4 weeks.
> >>
> >> How can we do something similar with Journald?
> > 
> > No, currenty you cannot. You can turn off storage from a certain log
> > level on (MaxLevelStore=), but you cannot change the retention time
> > per log level yet.
> 
> So if we set MaxLevelStore=INFO, we won't get the journal on disk
> stored. How much is stored in memory and how do you control that
> amount?

MaxLevelStore= controls what hits /run+/var, it makes not distinction
there. If you set MaxLevelStore= then this means debug messages get
dropped entirely.

> Right now, we don't store anything to disk ( no persistent disk in the
> system ) and why we're asking is that our DEBUG logs flushed the errors
> & warnings from last night, and we have no idea what actually went
> wrong.   Before this, we were storing things (syslogd) but after
> migrating to journald, we didn't figure out how to get them saved
> properly, so it's been punted onto the very long TODO list by us as well.
> 
> 
> Can I get a journal of ~50M (compressed?) stored on disk with Info and
> above levels, and then another 50M of debug+above in RAM?

Nope, this is currently not supported, but support a scheme like this
is on the TODO list.

Lennart

-- 
Lennart Poettering, Red Hat