Missing systemd journal log

Question

While reviewing my journal log, I find that only logs for the recent three days are present. There is only 8 lines worth of log from between September 19 and 27:

# journalctl --since="2014-09-19" --until="2014-09-27"
-- Logs begin at Fri 2014-09-19 22:12:13 UTC, end at Mon 2014-09-29 00:30:12 UTC. --
Sep 19 22:12:13 my.desktop systemd[3589]: Failed to open private bus connection: Failed to connect to socket /run/user/1001/dbus/
Sep 19 22:12:13 my.desktop systemd[3589]: Starting Default.
Sep 19 22:12:13 my.desktop systemd[3589]: Reached target Default.
Sep 19 22:12:13 my.desktop systemd[3589]: Startup finished in 32ms.
Sep 19 22:12:13 my.desktop sshd[3912]: ssh_selinux_copy_context: getcon failed with No such file or directory
Sep 19 22:14:12 my.desktop sshd[4420]: ssh_selinux_copy_context: getcon failed with No such file or directory
Sep 19 22:23:51 my.desktop sshd[4895]: ssh_selinux_copy_context: getcon failed with No such file or directory
Sep 19 23:00:00 my.desktop systemd[3589]: Stopping Default.

I did a check on my journald.conf and found the following lines:

Storage=auto
SystemMaxUse=40M

This means that the rest should follow the default configuration. From man page:

SystemMaxFileSize= and RuntimeMaxFileSize=
control how large individual journal files may grow at maximum. This influences the granularity in which disk space is made available through rotation, i.e. deletion of historic data. Defaults to one eighth of the values configured with SystemMaxUse= and RuntimeMaxUse=, so that usually seven rotated journal files are kept as history.

Since individual files are kept at one-eight of the SystemMaxUse, I expect journald to keep eight .journal log files for system with each being 5M in size. However, the list contains only four:

# ls -1lah system*
-rwxr-xr-x+ 1 root systemd-journal 5M Sep 27 14:40 system@d...1d0...d.journal
-rwxr-xr-x+ 1 root systemd-journal 5M Sep 28 09:40 system@d...1d1...0.journal
-rw-r-----+ 1 root systemd-journal 5M Sep 29 09:40 system@d...1d2...2.journal
-rw-r-----+ 1 root systemd-journal 5M Sep 29 10:42 system.journal

What happen to the other four files?

Answer 1

You're confusing the System prefix of the journald setting with the system/user journal separation.

SystemMaxUse sets the total disk space all of the journals will take up together, and doesn't take into account how system and user journals are split out. (Caveat here being that the limits are enforced when the journals are rotated and not directly as they are written to.)