[systemd-devel] systemd-journald: prioritize system log over user log

[Lennart Poettering]

On Thu, 23.03.17 19:13, Yunchih Chen (yunchih at csie.ntu.edu.tw) wrote:

> 
> 
> On 03/23/2017 06:29 PM, Michael Chapman wrote:
> > On Thu, 23 Mar 2017, Yunchih Chen wrote:
> > > Hello:
> > > 
> > >    At my organization, there can be hundreds of user logins in a
> > > public workstation each day, among more than one thousand of users.
> > > Since each user login produces a 8MiB sparse log file in
> > > /var/log/journal/xxxxx/, significant disk space is consumed. From
> > > the administrator point of view, it is desirable to prioritize
> > > system log over user log.  For example, when total log size exceeds
> > > SystemMaxUse, user log is vacuumed / rotated before system log.  Can
> > > we achieve this goal under current implementation?
> > 
> > I don't think journald has support for that itself currently.
> > 
> > Have you considered using SplitMode=none in journald.conf? If you do
> > that the per-UID journal files will not be created. Instead, all
> > messages will go into the system journal.
> > 
> > Of course, using SplitMode=none does mean unprivileged users probably
> > won't be able to view their own logs, but it does mean you won't get
> > this per-UID overhead.
> > 
> Thanks for your reply.  But we actually intend to let users view their own
> logs and we don't like to pollute system log with user log.  Maybe consider
> my original proposal as a feature request?

Please file feature requests on github, we'll consider them then.

https://github.com/systemd/systemd/issues/new

Lennart

-- 
Lennart Poettering, Red Hat