[systemd-devel] Settings in /etc/systemd/journald.conf dont work

[Kai Krakow]

Am Tue, 2 Feb 2016 11:09:51 +0100
schrieb Tommy_Lu <Tommy_Lu at gmx.de>:

> Hello
> 
> I am an old retired boy from German and a short-time visitor here in 
> this list. And I apologize, because I put my user-question here. But 
> unfortunately nowhere in the network i can found a solution or people 
> who have sufficient expertise. My Problem relates to "journalctl". I 
> want that Entries in my journal only the last 7 days are kept, 
> regardless of Journals Filesize. Therefor I have entered in the 
> /etc/systemd/journald.conf the following parameters:
> Storage = auto
> MaxRetentionSec = 1week
> 
> But nothing happens. The entries (older 7 days) will not be removed
> in runtime or after reboot. Even the entries in the
> "User-Actions-Journal" are not removed . Only when I reboot the
> Journals daemon the Systemjournal is completely emptied, what is also
> wrong. However, the Userjournal will remain unchanged and continue to
> contain month old data. What I would have to stop or do that I get
> these same 7 Days for both journals. I know that there are also
> "size-settings" are possible, but I'd like to set these 7-day cycle.
> 
> I use "Debian Jessie" as a Debootstrap-Setup with some selected LXDE 
> components for a custom Desktop_GUI.
> apt show systemd
>     Package: systemd
>     Version: 215-17+deb8u3
> 
> Can anyone help me with a advice? Many thanks for your help.
> Thomas

I think the following might happen: both limits (size-based and
time-based) still apply, and journald respects the limit that keeps
more journal entries. Thus, you may want to try to set SystemMaxUse to
a much smaller limit.

More likely: I pretty sure time-based retention can only be applied
during file rotation - means: when your per-file size limit is high, the
contained entries will not be removed until file rotation occurs - but
then they all are going to removed as the whole log file (all or
nothing).

Thus, you may also want experimenting with lowering the per-file size
limits so rotation occurs more often.

But this also means you will never get rid of old entries on a
per-hour, not even a per-day granularity. The settings only guarantee
that you always see the entries within the limits. It does not,
however, guarantee that you will never see entries outside of the
limits. But from an admin point of view that is perfectly sensible.
This is the guarantee you actually want.

So your only way is to tighten the granularity of log files, then use
the limit settings to throw away whole log database files.

If you want to see only specific entries back to some point in time,
you have to use a date filter when calling journalctl. Retention is
totally different approach and works as designed. There's a difference
between retention and filtering.

-- 
Regards,
Kai

Replies to list-only preferred.