Arch Linux

xerxes_

Member

Registered: 2018-04-29

Posts: 677

[SOLVED] History of boots had shrink itself - why?

Earlier on this system I had over 100 of history boots in logs ('journalctl --list-boots' command), that was something about a year of logs, but from some time I have even less than 30 of previous boots in journalctl logs. Because I boot system 2 or 3 times a day that means less than half a month of system logs.

I ignored it for some time, thinking that it may be some bug and repair itself which some update, but I see that it might not.

My question is: what happened? Was some change in systemd? I didn't change anything in configuration related to systemd logs.

Last edited by xerxes_ (2023-04-05 19:57:54)

Trilby

Inspector Parrot

Registered: 2011-11-29

Posts: 29,550

Website

Re: [SOLVED] History of boots had shrink itself - why?

Can you share the output of the following commands:

grep -v '^#' /etc/systemd/journald.conf
du -hd1 /var/log/journal

Also you may want to double check the title of this thread - I'm assuming there are typos.

Last edited by Trilby (2023-03-29 22:09:25)

---

"UNIX is simple and coherent..." - Dennis Ritchie, "GNU's Not UNIX" -  Richard Stallman

xerxes_

Member

Registered: 2018-04-29

Posts: 677

Re: [SOLVED] History of boots had shrink itself - why?

Output of commands:
grep -v '^#' /etc/systemd/journald.conf :

[Journal]

du -hd1 /var/log/journal :

8,0K	/var/log/journal/remote
387M	/var/log/journal/4e6eb13c33544bc2bce3efeaf0d12478
387M	/var/log/journal

So journald.conf was unchanged.

Current number of boots from command 'journalctl --list-boots' is from 0 to -28, so there is history from 29 boots.

Trilby

Inspector Parrot

Registered: 2011-11-29

Posts: 29,550

Website

Re: [SOLVED] History of boots had shrink itself - why?

Thanks, that (mostly) rules out my suspicion of a size constraint leading to purging entries.  This can be fully ruled out if your root filesystem is over 4G total size, and less than 85% currently used.  I'm not sure what else to check.

Last edited by Trilby (2023-03-30 21:09:25)

---

"UNIX is simple and coherent..." - Dennis Ritchie, "GNU's Not UNIX" -  Richard Stallman

xerxes_

Member

Registered: 2018-04-29

Posts: 677

Re: [SOLVED] History of boots had shrink itself - why?

Yes, my root file system is much bigger then 4GB and almost empty.

How many previous boots do you have (command 'journalctl --list-boots') and how much journalctl logs in MB you have? I want to compare.

Where can I change previous boots number? In journald.conf I don't see such option.

I don't know if this may be related, but from some time, when I run command 'journalctl --verify' I see many lines like this:
some_hex_value: Unused data (entry_offset==0)
for example:
39ab90: Unused data (entry_offset==0)
Also there are many lines with PASS, no line with FAIL, so it looks like logs shouldn't be corrupted.

Also command 'ls -l /var/log/journal/4e6eb13c33544bc2bce3efeaf0d12478/ | wc -l' returned 101 (mistake by 1).

Trilby

Inspector Parrot

Registered: 2011-11-29

Posts: 29,550

Website

Re: [SOLVED] History of boots had shrink itself - why?

The size of each of your journals seems reasonable - or at least comparable to mine.  My data is below for reference, but note that I do specifically limit the used size in journald.conf which is why I have so few - but on a MB / boot scale we are in the same range:

$ journalctl --list-boots
IDX BOOT ID                          FIRST ENTRY                 LAST ENTRY                 
 -5 b954dae24dbd48168aff30a95ea39638 Mon 2022-12-05 12:22:17 CST Wed 2023-01-11 15:06:17 CST
 -4 336f2a95b8074909abef75868a7295d4 Wed 2023-01-11 15:08:55 CST Thu 2023-01-12 10:37:05 CST
 -3 0995fe09aa4f419288ab973d69fcaf51 Thu 2023-01-12 10:37:16 CST Mon 2023-02-27 11:33:54 CST
 -2 09c1a6b7ff984c2084a1a9705dd43a8f Mon 2023-02-27 11:38:00 CST Mon 2023-03-20 08:16:36 CDT
 -1 5ef4a6fa019d45eb8a8924d8732002ca Mon 2023-03-20 08:23:26 CDT Mon 2023-03-20 08:24:35 CDT
  0 ba58ddcfb0634b6ba71fdefa84de6efe Mon 2023-03-20 08:24:46 CDT Thu 2023-03-30 17:43:52 CDT

$ du -hd1 /var/log/journal
113.9M	/var/log/journal/7e86b7d3de1a4700ad6f6d4d78a9c980
8.0K	/var/log/journal/remote
113.9M	/var/log/journal

I'm not familiar with the --verify flag, but I just ran it and had similar output to yours including the unsed data listings and a PASS for each of the files.  And if relevant, the comparable "wc -l" on my system shows 30 log files.

Last edited by Trilby (2023-03-30 22:50:52)

---

"UNIX is simple and coherent..." - Dennis Ritchie, "GNU's Not UNIX" -  Richard Stallman

schard

Forum Moderator

From: Hannover

Registered: 2016-05-06

Posts: 1,992

Website

Re: [SOLVED] History of boots had shrink itself - why?

SystemMaxFiles= and RuntimeMaxFiles= control how many individual journal files to keep at most. Note that only archived files are deleted to reduce the number of files until
           this limit is reached; active files will stay around. This means that, in effect, there might still be more journal files around in total than this limit after a vacuuming
           operation is complete. This setting defaults to 100.

$ journalctl --list-boots 
IDX BOOT ID                          FIRST ENTRY                  LAST ENTRY                  
-31 6aaeb0495eb94cee8a6c4fcff437f6da Tue 2023-03-14 08:48:09 CET  Tue 2023-03-14 09:25:18 CET
-30 1851335285674a64be7d59463af78a17 Tue 2023-03-14 11:19:01 CET  Tue 2023-03-14 16:52:14 CET
-29 2643de49f54943dd8aada9283e6a1ace Tue 2023-03-14 16:52:29 CET  Tue 2023-03-14 17:07:38 CET
-28 58bcd12697d049d6973ce2ccc013f729 Tue 2023-03-14 19:44:05 CET  Wed 2023-03-15 00:52:01 CET
-27 13cabe5063bc468d8d01eb61e6d054f4 Wed 2023-03-15 11:38:34 CET  Wed 2023-03-15 13:41:41 CET
-26 3df91bb2eda5491fac1b45a4075bc6bf Wed 2023-03-15 20:06:51 CET  Thu 2023-03-16 00:34:01 CET
-25 0cb0ea90628547a4ab89d0f9b4e8ba39 Thu 2023-03-16 08:53:59 CET  Thu 2023-03-16 09:22:42 CET
-24 7ab2a69ee8ba4c8fa3b172ac9cd7662f Thu 2023-03-16 21:26:00 CET  Thu 2023-03-16 22:48:14 CET
-23 c5092d8fb7494c66a8d42f6f770d6053 Fri 2023-03-17 08:51:43 CET  Fri 2023-03-17 09:06:01 CET
-22 94e75366751d426eaa045bcbfb4c25f1 Fri 2023-03-17 22:46:31 CET  Fri 2023-03-17 23:22:43 CET
-21 d7030639f84442818dfb8f5f580acb98 Sat 2023-03-18 20:46:57 CET  Sat 2023-03-18 21:33:58 CET
-20 1fdd407b6c9d4a17b7eb442b993eed60 Sun 2023-03-19 08:01:59 CET  Sun 2023-03-19 23:44:09 CET
-19 f8d76b75d33d4fc19b8ec4842851e402 Mon 2023-03-20 15:35:53 CET  Tue 2023-03-21 00:16:31 CET
-18 e2f9c08b787e40429021353382612a04 Tue 2023-03-21 20:35:55 CET  Tue 2023-03-21 21:58:08 CET
-17 6b19ee7e7101417fa5562552cb5e1e49 Tue 2023-03-21 21:58:19 CET  Tue 2023-03-21 22:00:04 CET
-16 a82c8f983bb44d4a8b779da27f06a699 Tue 2023-03-21 22:00:41 CET  Tue 2023-03-21 22:24:52 CET
-15 8a9a963a150a46d69c1f9864d2918c52 Wed 2023-03-22 08:41:42 CET  Wed 2023-03-22 09:20:18 CET
-14 6fa10c0379904fd1bfbaf9f3f799c157 Wed 2023-03-22 17:57:47 CET  Wed 2023-03-22 19:38:02 CET
-13 b4085a550a8f4c8d86376d7c9f59ea1d Wed 2023-03-22 22:51:35 CET  Thu 2023-03-23 00:32:40 CET
-12 d6e04b17e94c4f75b70e98364372ee89 Thu 2023-03-23 07:43:18 CET  Thu 2023-03-23 10:34:09 CET
-11 8e3333745d9e45b69ff8fd0c96d1a51f Thu 2023-03-23 18:04:42 CET  Fri 2023-03-24 03:08:18 CET
-10 ebb8ea5c2ad34b568be6e095244ddada Fri 2023-03-24 16:41:18 CET  Fri 2023-03-24 18:54:24 CET
 -9 b517ccf8271044edb9f7896c27b93d13 Sat 2023-03-25 02:32:28 CET  Sat 2023-03-25 06:42:08 CET
 -8 3b5a98fc0c5541a38f08fb5cdb5af7bf Sat 2023-03-25 23:33:53 CET  Sun 2023-03-26 00:06:46 CET
 -7 80d896d77a1745589a010950dadbf754 Sun 2023-03-26 11:02:35 CEST Mon 2023-03-27 02:03:34 CEST
 -6 b2335746da7f471584348ea9aa7730b3 Mon 2023-03-27 23:53:52 CEST Tue 2023-03-28 00:23:56 CEST
 -5 238c96601f744a6b87c1cb74812c4888 Tue 2023-03-28 07:47:15 CEST Tue 2023-03-28 07:57:52 CEST
 -4 f4f8e6863d2f4bef912ca17441889b4e Wed 2023-03-29 00:56:23 CEST Wed 2023-03-29 01:16:41 CEST
 -3 eeea264226c8482e890f0935ebec02f8 Wed 2023-03-29 08:37:17 CEST Wed 2023-03-29 09:26:47 CEST
 -2 691185f4dc2942d38a3d108b1e202d77 Thu 2023-03-30 01:03:58 CEST Thu 2023-03-30 01:31:35 CEST
 -1 7de922fa84684b0e8c0b3b2157de94fe Thu 2023-03-30 11:29:11 CEST Thu 2023-03-30 19:53:03 CEST
  0 79e405cb5c24462189f4993c9355488a Fri 2023-03-31 02:46:12 CEST Fri 2023-03-31 03:17:18 CEST

0 ✓ rne@envy /var/log/journal $ ls
31794151a85c4a25ba7bf01977a16b53  remote
0 ✓ rne@envy /var/log/journal $ ls 31794151a85c4a25ba7bf01977a16b53/ | wc -l
100
0 ✓ rne@envy /var/log/journal $ 

You might want to increase the amount of retained files.

Last edited by schard (2023-03-31 01:37:57)

---

macro_rules! yolo { { $($tokens:tt)* } => { unsafe { $($tokens)* } }; }

Trilby

Inspector Parrot

Registered: 2011-11-29

Posts: 29,550

Website

Re: [SOLVED] History of boots had shrink itself - why?

Oops, good catch.  I was looking at that section of the man page for the defaults but misread.  It's 100 files, not 100 boots.

---

"UNIX is simple and coherent..." - Dennis Ritchie, "GNU's Not UNIX" -  Richard Stallman

xerxes_

Member

Registered: 2018-04-29

Posts: 677

Re: [SOLVED] History of boots had shrink itself - why?

Like schard said, changing this 2 options over default 100 files makes more archive boots saved.
I wonder if there is option to make this files bigger and whether I should do it.