I'm using systemd on raspberrypi machine with yocto based system.
Recently I had some problems with redirecting messages to rsyslog.socket so I decided to get rid of rsyslog
completely in favour of of journald
.
After doing so I have noticed that size of journald files is much bigger than I previously thought it would be.
root@rpiDev: ~ $ journalctl -o cat > /tmp/journals-cat.txt
root@rpiDev: ~ $ journalctl -o export > /tmp/journals-exp.txt
root@rpiDev: ~ $ journalctl -o verbose > /tmp/journals-verb.txt
root@rpiDev: ~ $ journalctl -a -m > /tmp/journals.txt ### This is what I need!
root@rpiDev: ~ $ journalctl -a -m -o verbose > /tmp/journals-everything.txt
root@rpiDev: ~ $ du -sh /tmp/journals* /var/log/journal/ ; journalctl --disk-usage
468.0K /tmp/journals-cat.txt
15.7M /tmp/journals-everything.txt
4.7M /tmp/journals-exp.txt
4.9M /tmp/journals-verb.txt
2.3M /tmp/journals.txt
41.0M /var/log/journal/
Archived and active journals take up 12.5M on disk.
Comparing the sizes it looks like binary files created by journald are much bigger than merged (-m
) logs.
What I actually need is what is inside /tmp/journals.txt
.
Question:
Is it possible to reduce amount of stuff stored by journald in it's binary files to what I noticed when running journalctl -a -m
?
In other words: can I disable storing all of the information that is not important to me and use journald just as I would syslog?
My problem can be solved by disabling permanent storing of journald logs and forwarding them to syslog, but maybe it is possible without bringing back rsyslog?
EDIT:
Parameters mentioned by some users do not help me here.
- Using
SystemMaxUse=
andRuntimeMaxUse=
only sets the maximum size of the files stored- I can have smaller files with the same amount of not needed info and therefore even less actual logs. - Using
MaxLevel...=
sets the maximum log level stored in the journal. That is also not what I need here.
EDIT2:
My solution:
I have decided to store logs in syslog (I use rsyslog
).
In my journald.conf I have set Storage=volatile
and used SystemMaxUse=64M
and RuntimeMaxUse=64M
to limit disk usage by journald.
I also enabled ForwardToSyslog=yes
so now I have my old syslog solution working and I'm also able to view runtime journald logs.