11

From the documentation I know that I can configure

  1. the time after which journal files are deleted via MaxRetentionSec.
  2. the time after which journal files are rotated via MaxFileSec.

However my goal is to configure journald in a way such that all journal entries are stored within one file for a time span of one year. Older entries should be discarded.

My current workaround is that I have

  • MaxRetentionSec=1year
  • MaxFileSec=1month

This has, however, two major disadvantages.

  1. The journal is rotated after every month such that accessing older entries is a hassle.
  2. Journald will discard a whole month every time the year expires instead of just, let's say, one day.

Is it possible to configure the journal to behave as described in the goal?

Improve this question

2 Answers 2

Reset to default
5

Just found this brilliant answer on the askubuntu stackexchange: https://askubuntu.com/a/1012913/36168

To recap, the author suggests setting up a cronjob to run on a periodic basis, e.g for your use case, run this daily:

$ journalctl --vacuum-time=1y

Ref:

Improve this answer
5
  • Using SystemMaxUse would be more brilliant than cron-ing a temporary fix.
    – bfontaine
    Mar 29, 2021 at 7:28
  • 1
    How does SystemMaxUse help the OP, the question is about preserve the logs for a period of time, rather than limit by size use... or have I misread something?
    – tutuDajuju
    Mar 29, 2021 at 7:45
  • Sorry, it should be MaxRetentionSec.
    – bfontaine
    Mar 29, 2021 at 14:13
  • This does not answer the question - the OP secifically does not want to delete files, but entries within a file.
    – Remember Monica
    Feb 25, 2022 at 9:32
  • journald.conf.htm
    – Nick Dong
    Mar 16 at 16:15
2

However my goal is to configure journald in a way such that all journal entries are stored within one file for a time span of one year.

That means the file would rotate after 1 year, and be deleted after the last entry is more than 1 year old.

There is no way to do what you want. You have to do as with syslog and logrotate: rotate to several files, and delete the oldest ones. If you don't want to waste space for a month load of log, you rotate more often.

The journal is rotated after every month such that accessing older entries is a hassle

How is that? The journalctl utility reads all available journal files seamlessly.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .