3

I'm using systemd on raspberrypi machine with yocto based system. Recently I had some problems with redirecting messages to rsyslog.socket so I decided to get rid of rsyslog completely in favour of of journald.

After doing so I have noticed that size of journald files is much bigger than I previously thought it would be.

root@rpiDev: ~ $ journalctl -o cat > /tmp/journals-cat.txt
root@rpiDev: ~ $ journalctl -o export > /tmp/journals-exp.txt
root@rpiDev: ~ $ journalctl -o verbose > /tmp/journals-verb.txt
root@rpiDev: ~ $ journalctl -a -m > /tmp/journals.txt    ### This is what I need!
root@rpiDev: ~ $ journalctl -a -m -o verbose > /tmp/journals-everything.txt
root@rpiDev: ~ $ du -sh /tmp/journals* /var/log/journal/ ; journalctl --disk-usage
468.0K  /tmp/journals-cat.txt
15.7M   /tmp/journals-everything.txt
4.7M    /tmp/journals-exp.txt
4.9M    /tmp/journals-verb.txt
2.3M    /tmp/journals.txt
41.0M   /var/log/journal/
Archived and active journals take up 12.5M on disk.

Comparing the sizes it looks like binary files created by journald are much bigger than merged (-m) logs.

What I actually need is what is inside /tmp/journals.txt.

Question: Is it possible to reduce amount of stuff stored by journald in it's binary files to what I noticed when running journalctl -a -m?

In other words: can I disable storing all of the information that is not important to me and use journald just as I would syslog?

My problem can be solved by disabling permanent storing of journald logs and forwarding them to syslog, but maybe it is possible without bringing back rsyslog?

EDIT:

Parameters mentioned by some users do not help me here.

  • Using SystemMaxUse= and RuntimeMaxUse= only sets the maximum size of the files stored- I can have smaller files with the same amount of not needed info and therefore even less actual logs.
  • Using MaxLevel...= sets the maximum log level stored in the journal. That is also not what I need here.

EDIT2:

My solution:

I have decided to store logs in syslog (I use rsyslog).
In my journald.conf I have set Storage=volatile and used SystemMaxUse=64M and RuntimeMaxUse=64M to limit disk usage by journald.
I also enabled ForwardToSyslog=yes so now I have my old syslog solution working and I'm also able to view runtime journald logs.

bumped to the homepage by Community 20 hours ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

0

Edit /etc/systemd/journald.conf to specify how much space the journal can use, both in memory and on disk.

See man journald.conf for an in-depth explanation of the settings it contains.

  • 1
    It says in the question that SystemMaxUse and RuntimeMaxUse do not solve the issue. The problem is that journald journal has high level of complexity when comparing it with just syslog. The quesion is more about whether it is possible (and how) to reduce this complexity (answer: probably not possible) – lewiatan Apr 13 '17 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.