<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">#### [ System Environment ] ####<br>
On an embedded x86-64 Linux system, I’m running systemd v241. I have Systemd-Journald logging set to persistent with SystemMaxUse and RuntimeMaxUse both set to 512MB.
<o:p></o:p></p>
<p class="MsoNormal">The Linux system mount loops /var/log on start-up from a var-log.ext4 file. The /var/log mount is given a fixed size of the disk (976MB). Systemd creates a journal entry directory given a hash name in /var/log/journal/<hash1>.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">#### [ System Information ] ####<o:p></o:p></p>
<p class="MsoNormal">Linux 4.19.0-6-2-amd64 #1 SMP Debian 4.19.67-2+deb10u2 (2019-11-11) x86_64 GNU/Linux<o:p></o:p></p>
<p class="MsoNormal"><br>
#### [ Problem ] ####<o:p></o:p></p>
<p class="MsoNormal">When the system firmware is upgraded, Systemd creates a new journal entry directory with a different hash name and no longer recognizes the previous hash directory.
<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">The old logs from the previous journal entry can no longer be managed. The old logs are never rotated and cannot be manually rotated using the journaldctl cli. The disk usage calculator by Journald does not
account for the previous journal entry meaning if there are two previous entries in /var/log that consume 900MB of space; then the new journal entry only has 76MB of space to work with. Eventually, disk space will be full. Journald cannot automatically flush,
vacuum, clean, rotate previous logs because it does not recognize the previous journal entries.<o:p></o:p></p>
<p class="MsoNormal">There must be a systemd journald check that occurs where it determines these other entries are not for it to manage.<o:p></o:p></p>
<p class="MsoNormal"><br>
#### [ Problem Output ] ####<br>
Disk usage of /var/log by Journald:<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><i>~$ du -m --max-depth=1 /var/log/journal<o:p></o:p></i></p>
<p class="MsoNormal" style="margin-left:.5in;text-indent:.5in"><i>115 /var/log/journal/990cf742bf724548b6eb3e7479b715b8<o:p></o:p></i></p>
<p class="MsoNormal" style="margin-left:.5in;text-indent:.5in"><i>82 /var/log/journal/f1ab90ffe26f453a880194dd1de999a2<o:p></o:p></i></p>
<p class="MsoNormal" style="margin-left:.5in;text-indent:.5in"><i>51 /var/log/journal/c3eb2c473e08407cb6ee04d3d1ebe989</i><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Journald disk usage (Note: Does not recognize previous journal entries.)<i><o:p></o:p></i></p>
<p class="MsoNormal" style="text-indent:.5in"><i>~$ sudo journalctl --disk-usage<o:p></o:p></i></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:.5in;text-indent:.5in">
<i>Archived and active journals take up 114.7M in the file system.<o:p></o:p></i></p>
<p class="MsoNormal">Journald not finding previous journal entry hashes:<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><i>~$ journalctl --verify<o:p></o:p></i></p>
<p class="MsoNormal" style="margin-left:.5in;text-indent:.5in"><i>PASS: /var/log/journal/990cf742bf724548b6eb3e7479b715b8/user-1000.journal<o:p></o:p></i></p>
<p class="MsoNormal" style="margin-left:.5in;text-indent:.5in"><i>PASS: <a href="mailto:/var/log/journal/990cf742bf724548b6eb3e7479b715b8/user-1000@13f6f398cdda4e8f9952ebea46e6b6b4-000000000000161c-0005d91af94b8136.journal">
/var/log/journal/990cf742bf724548b6eb3e7479b715b8/user-1000@13f6f398cdda4e8f9952ebea46e6b6b4-000000000000161c-0005d91af94b8136.journal</a><o:p></o:p></i></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:.5in;text-indent:.5in">
<i>PASS: <a href="mailto:/var/log/journal/990cf742bf724548b6eb3e7479b715b8/user-1000@49e1241c0f3c497a888c8fb4d74c2c00-00000000000006b1-0005d91aeeccea06.journal">
/var/log/journal/990cf742bf724548b6eb3e7479b715b8/user-1000@49e1241c0f3c497a888c8fb4d74c2c00-00000000000006b1-0005d91aeeccea06.journal</a><o:p></o:p></i></p>
<p class="MsoNormal">#### [ Question ] ####<o:p></o:p></p>
<p class="MsoNormal">Is there a way to define or set a re-usable Systemd-Journald entry under /var/log/journal that can be used after system upgrades?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I can provide any additional system details or logs. <o:p></o:p></p>
<p class="MsoNormal">Thank you for any feedback or support.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-Eric Z<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
CONFIDENTIALITY NOTICE: This e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and may contain confidential and privileged information protected by law. If you received this e-mail
in error, any review, use, dissemination, distribution, or copying of the e-mail is strictly prohibited. Please notify the sender immediately by return e-mail and delete all copies from your system.
</body>
</html>