[systemd-devel] journald deleting logs on LiveOS boots

[Uoti Urpala]

On Thu, 2019-07-18 at 21:52 -0600, Chris Murphy wrote:
> # df -h
> ...
> /dev/mapper/live-rw  6.4G  5.7G  648M  91% /
> 
> And in the log:
> 47,19636,16754831,-;systemd-journald[905]: Fixed min_use=1.0M
> max_use=648.7M max_size=81.0M min_size=512.0K keep_free=973.1M
> n_max_files=100
> 
> Why is keep_free bigger than available free space? Is that the cause
> of the vacuuming?

The default value for keep_free is the smaller of 4 GiB or 15% of total
filesystem size. Since the filesystem is small and has less than 15%
free, it's already over the default limit. Those defaults are defined
in src/journal/journal_file.c. When over the limit, journald still uses
at least DEFAULT_MIN_USE (increased to the initial size of journals on
disk if any). But it looks suspicious that this is 1 MiB while 
FILE_SIZE_INCREASE is 8 MiB - doesn't this imply that any use at all
immediately goes over 1 MiB?

You can probably work around the issue by setting a smaller
SystemKeepFree in journald.conf.