[systemd-devel] default journal retention policy

[Chris Murphy]

Hi,

Fedora Workstation working group is considering reducing the journal retention policy from upstream default. 

This is the tracking issue
https://pagure.io/fedora-workstation/issue/213

This is the Fedora development list discussion thread
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/NDO5S2KUUDO5G6JLKZGQNFBXOW5KHPR5/#XATT3XYFV2UALPTJTL5RSQD3D4IVNSVO

As Lennart mentions in that devel thread, it's preferred that the change be upstreamable, and the Fedora Workstation working group agrees.
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/XATT3XYFV2UALPTJTL5RSQD3D4IVNSVO/

The consensus of the discussion is that there should be less retention. The range of retention varies quite a bit, but I think 3-6 months is OK.

In practice, most configurations eventually up with 4G of journals, since that's the cap. This typically is over a year of journals, but of course it really depends on additional configuration, e.g. in my case I do a lot of debugging, so I'm often enabling debug logging, therefore 4G worth of journal files happens pretty quick, maybe 3 months.

As I understand it, rsyslog has a two week retention policy by default.

journald supports quite a lot of knobs related to journal total size, free space, file sizes, and rentention time. My favorite simple idea of the moment is to set a default MaxRetentionSec=100day which translates to "probably not less than 90 days, but not more than 100 days" of retention. The policy looks at entry age to determine if the retention threshold is met, but the garbage collection affects journal files. So if a single entry in a file reaches 100 days, the whole file is deleted, which could plausibly be a week or two of entries. 

Still another idea, we could add a new setting MinRetentionSec=90day which would translate into "not less than 90 days" and would only delete journal files once all the entries in a journal file are at least 90 days old.

By leaving all the other settings alone, the 4G cap (or if less, the 10% of file system size rule) still applies. So in no case would any use case end up using more space for logs.

Any thoughts?


--
Chris Murphy