[systemd-devel] Journald retaining logs for only 10 days

[Andrei Borzenkov]

14.11.2020 22:18, Nikolaus Rath пишет:
> On Nov 14 2020, Andrei Borzenkov <arvidjaar at gmail.com> wrote:
>> 14.11.2020 14:32, Nikolaus Rath пишет:
>> ...
>>>>>
>>>>> # grep -vE '^#' /etc/systemd/journald.conf
>>>>>
>>>>> [Journal]
>>>>> SystemMaxUse=300M
>>>>
>>>> The number shown by disk usage (320 MB) is higher than 300 MB. Maybe also check the files
>>>> in `/var/log/journal`.
>>>
>>> It's a bit bigger on disk too:
>>>
>>> # du -hs /var/log/journal
>>> 321M	/var/log/journal
>>>
>>> journalctl --verify does not find any errors.
>>>
>>>
>>> Could that be related to the short retention, or is this an unrelated problem?
>>>
>>
>> It is not a "problem". You told journald to keep 300M of data and it
>> does exactly that.
> 
> Hu? As far as I can tell, I told it to keep 300 MB and it's using 320
> MB.

For all I can tell, SystemMaxUse applies to inactive journal files only
- this sets target how many archived files to delete. systemd will
switch to new file and archive current if currently active file exceeds
max size. Max journal file size is by default set to 1/8th of max
allowed space. Which means with SystemMaxUse=300M max journal file size
is set to 37.5MiB and at any time you may have up to 300MiB of old files
and one currently active file which may grow up to 37.5MiB. So 337.5MiB
in total.

And my understanding is that every user's journal adds to this - so
basically you will have additionally 37.5MiB x number of active user
sessions.

If someone more familiar with journal internals will confirm it, it
calls for documentation update. While manual page says "Also note that
only archived files are deleted to reduce the space occupied by journal
files" it does not make clear that limits effectively apply to archived
files only and active files may additionally consume up to
SystemMaxFileSize each before something triggers rotation.

This is actually in line with SystemMaxFiles which does not remove
active files either. So setting SystemMaxFiles=0 will remove archived
files but leave any active file untouched.

> Furthermore, in these 320 MB it seemingly only stored 27 MB worth of
> log data.
> 

That's rather different issue.