[systemd-devel] Antw: [EXT] Re: Journald retaining logs for only 10 days

[Vito Caputo]

On Mon, Nov 16, 2020 at 08:18:28AM +0100, Ulrich Windl wrote:
> >>> Vito Caputo <vcaputo at pengaru.com> schrieb am 14.11.2020 um 21:29 in
> Nachricht
> <20201114202930.x7wbx4p37bkkwona at shells.gnugeneration.com>:
> > On Sat, Nov 14, 2020 at 09:31:23AM +0000, Nikolaus Rath wrote:
> >> Hello,
> >> 
> >> I just discovered that on one of my systems journald only retains log
> >> entries for about 10 days:
> >> 
> >> # journalctl | head ‑1
> >> ‑‑ Logs begin at Wed 2020‑11‑04 15:57:13 UTC, end at Sat 2020‑11‑14
> 09:28:19 UTC. ‑‑
> >> 
> >> I do not understand what could cause this, because I have no retention
> >> limit configured, and the logs take up way less space than I have
> >> reserved:
> >> 
> >> # journalctl ‑‑disk‑usage
> >> Archived and active journals take up 320.0M in the file system.
> >> 
> >> # journalctl > alllogs
> >> # ls ‑lh alllogs 
> >> ‑rw‑r‑‑r‑‑ 1 root root 27M Nov 14 09:24 alllogs
> >> 
> >> 
> >> Can someone help me understand where the log entries have gone?
> >> 
> >> # journalctl ‑‑version
> >> systemd 241 (241)
> >> +PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP 
> > +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD ‑IDN2 +IDN
> ‑PCRE2 
> > default‑hierarchy=hybrid
> >> 
> >> # grep ‑vE '^#' /etc/systemd/journald.conf 
> >> 
> >> [Journal]
> >> SystemMaxUse=300M
> >> 
> >> 
> > 
> > One thing to consider is journald allocates space per‑file in 8MiB
> > increments.
> 
> Why that? Because disk space is cheap? 8MB of text log files is a really huge
> amount of lines.
> For example here I have about 9500 lines in 860MB; that would be about 92500
> lines for 8MB.
> 

Well, I'm not the original author of that bit, but journald does all
its IO via mmap windows so it needs to allocate the space before
mapping it in for writing.  Doing it in bigger chunks seems likely to
be an optimization to amortize FS's file allocation costs across more
journal writes than just the current one.  It probably helps reduce
fragmentation of the journal file in some cases too.

Regards,
Vito Caputo