2

I am trying to understand what journald does in relation to persistent storage of log entries. I have an SDCard setup so I am looking to keep disk writes to a minimum, but would like some persistence in logging via journald.

Out of the box (Raspbian) journald uses Storage=auto i.e. unless there is a mount for /var/log/journal it will simply store all logs to RAM.

The question is, if there is a mount point /var/log/journal, does journald continue to use RAM where it can, or does it default to writing everything to disk?

If it does write to RAM primarily, what default mechanisms are setup to manage the persistence of logs?

3

Extract from journal.conf manpage

       Storage=
           Controls where to store journal data. One of "volatile", "persistent", "auto" and "none". If "volatile", journal log data
           will be stored only in memory, i.e. below the /run/log/journal hierarchy (which is created if needed). If "persistent",
           data will be stored preferably on disk, i.e. below the /var/log/journal hierarchy (which is created if needed), with a
           fallback to /run/log/journal (which is created if needed), during early boot and if the disk is not writable.  "auto" is
           similar to "persistent" but the directory /var/log/journal is not created if needed, so that its existence controls where
           log data goes.  "none" turns off all storage, all log data received will be dropped. Forwarding to other targets, such as
           the console, the kernel log buffer, or a syslog socket will still work however. Defaults to "auto".

According to me, in auto mode, the sentence so that its existence controls where log data goes clearly states that :

  • without /var/log/journal, logs are only written to /run/log/journal
  • with /var/log/journal, logs are only written to /var/log/journal
  • In that case, why would you need the flush command to clear data from /run/log/journal to /var/log/journal. It implies some caching. – Brian Apr 19 at 11:02
  • 1
    From journalctl --flushmanpage, the data is only flushed from /run/log/journal into /var/log/journal once during system runtime. From source code [github.com/systemd/systemd/blob/master/src/journal/… you can see that once the /run/systemd/journal/flushed exists, this command does nothing (also explained in the man page). So, it is most probably used when you move from volatile to persistent storage on a running system. – Chaoxiang N Apr 19 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.