[systemd-devel] systemd-journald: prioritize system log over user log

[Michael Chapman]

On Thu, 23 Mar 2017, Yunchih Chen wrote:
> Hello:
>
>    At my organization, there can be hundreds of user logins in a public 
> workstation each day, among more than one thousand of users.  Since each user 
> login produces a 8MiB sparse log file in /var/log/journal/xxxxx/, significant 
> disk space is consumed.  From the administrator point of view, it is 
> desirable to prioritize system log over user log.  For example, when total 
> log size exceeds SystemMaxUse, user log is vacuumed / rotated before system 
> log.  Can we achieve this goal under current implementation?

I don't think journald has support for that itself currently.

Have you considered using SplitMode=none in journald.conf? If you do that 
the per-UID journal files will not be created. Instead, all messages will 
go into the system journal.

Of course, using SplitMode=none does mean unprivileged users probably 
won't be able to view their own logs, but it does mean you won't get 
this per-UID overhead.

-- 
Michael