[systemd-devel] Journald retaining logs for only 10 days

[Paul Menzel]

Dear Nikolaus,


Am 14.11.20 um 10:31 schrieb Nikolaus Rath:

> I just discovered that on one of my systems journald only retains log
> entries for about 10 days:
> 
> # journalctl | head -1
> -- Logs begin at Wed 2020-11-04 15:57:13 UTC, end at Sat 2020-11-14 09:28:19 UTC. --
> 
> I do not understand what could cause this, because I have no retention
> limit configured, and the logs take up way less space than I have
> reserved:
> 
> # journalctl --disk-usage
> Archived and active journals take up 320.0M in the file system.
> 
> # journalctl > alllogs
> # ls -lh alllogs
> -rw-r--r-- 1 root root 27M Nov 14 09:24 alllogs

What size does adding the switch `-a` result in? From journalctl(1):

>        -a, --all
>            Show all fields in full, even if they include unprintable
>            characters or are very long. By default, fields with unprintable
>            characters are abbreviated as "blob data". (Note that the pager may
>            escape unprintable characters again.)

> Can someone help me understand where the log entries have gone?
> 
> # journalctl --version
> systemd 241 (241)
> +PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN -PCRE2 default-hierarchy=hybrid
> 
> # grep -vE '^#' /etc/systemd/journald.conf
> 
> [Journal]
> SystemMaxUse=300M

The number shown by disk usage (320 MB) is higher than 300 MB. Maybe 
also check the files in `/var/log/journal`.


Kind regards,

Paul