2

While reviewing my journal log, I find that only logs for the recent three days are present. There is only 8 lines worth of log from between September 19 and 27:

# journalctl --since="2014-09-19" --until="2014-09-27"
-- Logs begin at Fri 2014-09-19 22:12:13 UTC, end at Mon 2014-09-29 00:30:12 UTC. --
Sep 19 22:12:13 my.desktop systemd[3589]: Failed to open private bus connection: Failed to connect to socket /run/user/1001/dbus/
Sep 19 22:12:13 my.desktop systemd[3589]: Starting Default.
Sep 19 22:12:13 my.desktop systemd[3589]: Reached target Default.
Sep 19 22:12:13 my.desktop systemd[3589]: Startup finished in 32ms.
Sep 19 22:12:13 my.desktop sshd[3912]: ssh_selinux_copy_context: getcon failed with No such file or directory
Sep 19 22:14:12 my.desktop sshd[4420]: ssh_selinux_copy_context: getcon failed with No such file or directory
Sep 19 22:23:51 my.desktop sshd[4895]: ssh_selinux_copy_context: getcon failed with No such file or directory
Sep 19 23:00:00 my.desktop systemd[3589]: Stopping Default.

I did a check on my journald.conf and found the following lines:

Storage=auto
SystemMaxUse=40M

This means that the rest should follow the default configuration. From man page:

SystemMaxFileSize= and RuntimeMaxFileSize=
control how large individual journal files may grow at maximum. This influences the granularity in which disk space is made available through rotation, i.e. deletion of historic data. Defaults to one eighth of the values configured with SystemMaxUse= and RuntimeMaxUse=, so that usually seven rotated journal files are kept as history.

Since individual files are kept at one-eight of the SystemMaxUse, I expect journald to keep eight .journal log files for system with each being 5M in size. However, the list contains only four:

# ls -1lah system*
-rwxr-xr-x+ 1 root systemd-journal 5M Sep 27 14:40 system@d...1d0...d.journal
-rwxr-xr-x+ 1 root systemd-journal 5M Sep 28 09:40 system@d...1d1...0.journal
-rw-r-----+ 1 root systemd-journal 5M Sep 29 09:40 system@d...1d2...2.journal
-rw-r-----+ 1 root systemd-journal 5M Sep 29 10:42 system.journal

What happen to the other four files?

  • Can you paste the output of journalctl --disk-usage ? – Mark Plotnick Sep 29 '14 at 3:42
  • @MarkPlotnick, it says Journals take up 55.0M on disk.. This is correct as I have user logs taking up 35M of space. – Question Overflow Sep 29 '14 at 3:50
1

You're confusing the System prefix of the journald setting with the system/user journal separation.

SystemMaxUse sets the total disk space all of the journals will take up together, and doesn't take into account how system and user journals are split out. (Caveat here being that the limits are enforced when the journals are rotated and not directly as they are written to.)

  • Ah, you are right. I wasn't reading the man page carefully. I have another related question at server fault, if you happen to know the answer, would appreciate your help. Thanks! – Question Overflow Oct 5 '14 at 3:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.