I'm using systemd on raspberrypi machine with yocto based system.
Recently I had some problems with redirecting messages to rsyslog.socket so I decided to get rid of
rsyslog completely in favour of of
After doing so I have noticed that size of journald files is much bigger than I previously thought it would be.
root@rpiDev: ~ $ journalctl -o cat > /tmp/journals-cat.txt
root@rpiDev: ~ $ journalctl -o export > /tmp/journals-exp.txt
root@rpiDev: ~ $ journalctl -o verbose > /tmp/journals-verb.txt
root@rpiDev: ~ $ journalctl -a -m > /tmp/journals.txt ### This is what I need!
root@rpiDev: ~ $ journalctl -a -m -o verbose > /tmp/journals-everything.txt
root@rpiDev: ~ $ du -sh /tmp/journals* /var/log/journal/ ; journalctl --disk-usage
Archived and active journals take up 12.5M on disk.
Comparing the sizes it looks like binary files created by journald are much bigger than merged (
What I actually need is what is inside
Is it possible to reduce amount of stuff stored by journald in it's binary files to what I noticed when running
journalctl -a -m?
In other words: can I disable storing all of the information that is not important to me and use journald just as I would syslog?
My problem can be solved by disabling permanent storing of journald logs and forwarding them to syslog, but maybe it is possible without bringing back rsyslog?
Parameters mentioned by some users do not help me here.
RuntimeMaxUse=only sets the maximum size of the files stored- I can have smaller files with the same amount of not needed info and therefore even less actual logs.
MaxLevel...=sets the maximum log level stored in the journal. That is also not what I need here.
I have decided to store logs in syslog (I use
In my journald.conf I have set
Storage=volatile and used
RuntimeMaxUse=64M to limit disk usage by journald.
I also enabled
ForwardToSyslog=yes so now I have my old syslog solution working and I'm also able to view runtime journald logs.