[systemd-devel] Journald retaining logs for only 10 days

[Mantas Mikulėnas]

On Sat, Nov 14, 2020 at 11:31 AM Nikolaus Rath <Nikolaus at rath.org> wrote:

> Hello,
>
> I just discovered that on one of my systems journald only retains log
> entries for about 10 days:
>
> # journalctl | head -1
> -- Logs begin at Wed 2020-11-04 15:57:13 UTC, end at Sat 2020-11-14
> 09:28:19 UTC. --
>
> I do not understand what could cause this, because I have no retention
> limit configured, and the logs take up way less space than I have
> reserved:
>
> # journalctl --disk-usage
> Archived and active journals take up 320.0M in the file system.
>
> # journalctl > alllogs
> # ls -lh alllogs
> -rw-r--r-- 1 root root 27M Nov 14 09:24 alllogs
>

That just shows the 'MESSAGE' field -- it does not show any other fields
that each entry will have stored, such as the unit name which generated the
message; the program's command line; and apparently even the original
unparsed packet that was received through /dev/log. Try `journalctl -o
export` to get a closer idea of what the messages in systemd-journal look
like.

For example, on one of my servers, a plain `journalctl -a` outputs 260 MB
of data, but `journalctl -o export` is 1.9 GB. (Which is still not quite
the same as 2.4 GB of *.journal files, but there's always going to be some
discrepancy due to how a binary database allocates space.)

-- 
Mantas Mikulėnas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/systemd-devel/attachments/20201114/4d45bc8b/attachment.htm>