[systemd-devel] Both volatile and persistent journald logs

[Cam Hutchison]

I am migrating to systemd/journald (via an upgrade from Debian wheezy to
jessie) and I've come across a problem migrating that is peculiar to my
setup.

I currently have /var/log on an SSD. I also have some noisy logs. In
attempt to not have rsyslog write continuously to the SSD, I have set up
some syslog facilities and special filters to log to /run/log files
instead of /var/log for those noise logs. I have an hourly cron job
that runs logrotate on the /run/log files and appends the rotated log
(the .1 file) to the persistent logs in /var/log.

I would like to be able to do something similar with journald.

The specifics of my logging that is temporarily volatile is captured in
these rsyslog configs:

local1.*                        /tmp/log/dnsmasq.log
local4.*                        /tmp/log/ldap.log
if $syslogfacility-text == 'kern' and $msg contains 'firewall:' then /tmp/log/firewall.log

I am aware that on an unclean shutdown these logs get lost. I am ok with
that. They are mostly useful for realtime debugging and not historical
analysis. In the rare event of an unclean shutdown, I accept this loss
(I've not yet had such a shutdown).

Is there a way to configure journald to do something similar?

Is there some other mechanism that can address excessive log writing to
an SSD?