[systemd-devel] systemd-journald: prioritize system log over user log
mike at very.puzzling.org
Thu Mar 23 10:29:01 UTC 2017
On Thu, 23 Mar 2017, Yunchih Chen wrote:
> At my organization, there can be hundreds of user logins in a public
> workstation each day, among more than one thousand of users. Since each user
> login produces a 8MiB sparse log file in /var/log/journal/xxxxx/, significant
> disk space is consumed. From the administrator point of view, it is
> desirable to prioritize system log over user log. For example, when total
> log size exceeds SystemMaxUse, user log is vacuumed / rotated before system
> log. Can we achieve this goal under current implementation?
I don't think journald has support for that itself currently.
Have you considered using SplitMode=none in journald.conf? If you do that
the per-UID journal files will not be created. Instead, all messages will
go into the system journal.
Of course, using SplitMode=none does mean unprivileged users probably
won't be able to view their own logs, but it does mean you won't get
this per-UID overhead.
More information about the systemd-devel