Arch Linux

p91paul

Member

Registered: 2015-06-29

Posts: 2

Journald log rotation

Hi everybody.

It is well-known (also stated in the wiki: https://wiki.archlinux.org/index.php/Sy … over_time) that journal size has an impact on boot time, and also on the execution time of commands like

 journalctl 

or

 systemctl status <service> 

.

The issue is solved setting a low value for the SystemMaxUse parameter of journald. However, this doesn't allow to keep old logs for future reference.

I would like for it:
* To rotate logs when they reach a small size, say 50MB
* To keep something like 5GB or more of logs, to be able to record stuff happened for months
* To make sure journalctl, by default, reads only the latest of the 50MB files, to keep reading times short

I believe the only solution is currently forward logs to syslog as described in https://wiki.archlinux.org/index.php/Sy … md_journal, then let logrotate handle rotation of syslog logs, to allow keeping them for months/years; at the same time, set SystemMaxUse to 50MB to avoid impacting performance of journald.

However, this way I cannot filter old logs through journalctl; is there a better solutions that automatically rotates journald logs where journald cannot read them unless explicitly told so, and removes them only when they hit a much higher size limit (or time limit)?

Last edited by p91paul (2015-07-20 15:18:24)

Raynman

Member

Registered: 2011-10-22

Posts: 1,539

Re: Journald log rotation

(Untested, I only did some man page reading:)

* To rotate logs when they reach a small size, say 50MB

set SystemMaxFileSize=50M

* To keep something like 5GB or more of logs, to be able to record stuff happened for months

set SystemMaxUse=5G

* To make sure journalctl, by default, reads only the latest of the 50MB files, to keep reading times short

You could go with

alias journalctl="journalctl --file=/var/log/journal/$(cat /etc/machine-id)/system.journal"