[systemd-devel] Journald retaining logs for only 10 days

[Nikolaus Rath]

On Nov 14 2020, Paul Menzel <pmenzel+systemd-devel at molgen.mpg.de> wrote:
>> I just discovered that on one of my systems journald only retains log
>> entries for about 10 days:
>>
>> # journalctl | head -1
>> -- Logs begin at Wed 2020-11-04 15:57:13 UTC, end at Sat 2020-11-14 09:28:19 UTC. --
>>
>> I do not understand what could cause this, because I have no retention
>> limit configured, and the logs take up way less space than I have
>> reserved:
>>
>> # journalctl --disk-usage
>> Archived and active journals take up 320.0M in the file system.
>>
>> # journalctl > alllogs
>> # ls -lh alllogs
>> -rw-r--r-- 1 root root 27M Nov 14 09:24 alllogs
>
> What size does adding the switch `-a` result in? From journalctl(1):

No significant difference:

# journalctl -a > alllogs
# ls -lh alllogs 
-rw-r--r-- 1 root root 28M Nov 14 11:31 alllogs

>> Can someone help me understand where the log entries have gone?
>>
>> # journalctl --version
>> systemd 241 (241)
>> +PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN -PCRE2 default-hierarchy=hybrid
>>
>> # grep -vE '^#' /etc/systemd/journald.conf
>>
>> [Journal]
>> SystemMaxUse=300M
>
> The number shown by disk usage (320 MB) is higher than 300 MB. Maybe also check the files
> in `/var/log/journal`.

It's a bit bigger on disk too:

# du -hs /var/log/journal
321M	/var/log/journal

journalctl --verify does not find any errors.


Could that be related to the short retention, or is this an unrelated problem?


Best,
-Nikolaus


-- 
GPG Fingerprint: ED31 791B 2C5C 1613 AF38 8B8A D113 FCAC 3C4E 599F

             »Time flies like an arrow, fruit flies like a Banana.«