[systemd-devel] journald deleting logs on LiveOS boots

[Chris Murphy]

This is suspicious:

# df -h
...
/dev/mapper/live-rw  6.4G  5.7G  648M  91% /

And in the log:
47,19636,16754831,-;systemd-journald[905]: Fixed min_use=1.0M
max_use=648.7M max_size=81.0M min_size=512.0K keep_free=973.1M
n_max_files=100

Why is keep_free bigger than available free space? Is that the cause
of the vacuuming?

47,19867,16908013,-;systemd-journald[905]:
/var/log/journal/05d0a9c86a0e4bbcb36c5e0082b987ee/system.journal:
Allocation limit reached, rotating.
47,19868,16908029,-;systemd-journald[905]: Rotating...

And then

47,27860,22417049,-;systemd-journald[905]: Vacuuming...
47,27861,22427712,-;systemd-journald[905]: Deleted archived journal
/var/log/journal/05d0a9c86a0e4bbcb36c5e0082b987ee/system at daa6e38474b84afc8404527c7b204c24-0000000000000001-00058dff129d34ae.journal
(8.0M).
47,27862,22427724,-;systemd-journald[905]: Vacuuming done, freed 8.0M
of archived journals from
/var/log/journal/05d0a9c86a0e4bbcb36c5e0082b987ee.

That vacuuming event is the direct cause of the data loss. But does it
happen because keep_free is greater than free space, and if so then
why is keep_free greater than free space?

Slightly off topic but why are there over 18000 (that's not a typo) of
these identical lines? It seems excessive.

47,27869,22428300,-;systemd-journald[905]: Journal effective settings
seal=no compress=yes compress_threshold_bytes=512B

I've updated the bug report to include an attachment of the journal
I've captured by forwarding to kmsg.

https://bugzilla.redhat.com/show_bug.cgi?id=1715699#c17


Chris Murphy