[systemd-devel] Journald retaining logs for only 10 days

[Mantas Mikulėnas]

On Sat, Nov 14, 2020, 20:17 Mantas Mikulėnas <grawity at gmail.com> wrote:

> On Sat, Nov 14, 2020 at 11:31 AM Nikolaus Rath <Nikolaus at rath.org> wrote:
>
>> Hello,
>>
>> I just discovered that on one of my systems journald only retains log
>> entries for about 10 days:
>>
>> # journalctl | head -1
>> -- Logs begin at Wed 2020-11-04 15:57:13 UTC, end at Sat 2020-11-14
>> 09:28:19 UTC. --
>>
>> I do not understand what could cause this, because I have no retention
>> limit configured, and the logs take up way less space than I have
>> reserved:
>>
>> # journalctl --disk-usage
>> Archived and active journals take up 320.0M in the file system.
>>
>> # journalctl > alllogs
>> # ls -lh alllogs
>> -rw-r--r-- 1 root root 27M Nov 14 09:24 alllogs
>>
>
> That just shows the 'MESSAGE' field -- it does not show any other fields
> that each entry will have stored, such as the unit name which generated the
> message; the program's command line; and apparently even the original
> unparsed packet that was received through /dev/log. Try `journalctl -o
> export` to get a closer idea of what the messages in systemd-journal look
> like.
>
> For example, on one of my servers, a plain `journalctl -a` outputs 260 MB
> of data, but `journalctl -o export` is 1.9 GB. (Which is still not quite
> the same as 2.4 GB of *.journal files, but there's always going to be some
> discrepancy due to how a binary database allocates space.)
>

One specific reason is that journal files are indexed – you can search them
by any field value, without needing to do a full linear grep. (This is how
"systemctl status" shows just one unit's logs, for example.) The indexes
are stored along with the data, so the .journal files will be larger than
the corresponding "-o export" dump.

>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/systemd-devel/attachments/20201114/8e6938eb/attachment.htm>