2

I set up my journald to limit the log size to 5GB in /etc/systemd/journald.conf and thought everything was fine. Then, yesterday, I realized that my /var/log/syslog file is in fact 12GB big.

What I believed was that journalctl is reading the messages from different log locations, and that the SystemMaxUse option is meant to limit their size. But as it seems, it is not.

I ended up using logrotate now with the size option but I would prefer to understand the concept for the future.

It looks like I have not really understood how the logs in /var/log are entangled with journald/journalctl. Please enlighten me!

0

2 Answers 2

1

systemd-journald also writes in /run/log/journal.

--flush

Asks the journal daemon to flush any log data stored in /run/log/journal/ into /var/log/journal/, if persistent storage is enabled. This call does not return until the operation is complete.

Note that this call is idempotent: the data is only flushed from /run/log/journal/ into /var/log/journal/ once during system runtime (but see --relinquish-var below), and this command exits cleanly without executing any operation if this has already happened. This command effectively guarantees that all data is flushed to /var/log/journal/ at the time it returns.

--relinquish-var

Asks the journal daemon for the reverse operation to --flush: if requested the daemon will write further log data to /run/log/journal/ and stops writing to /var/log/journal/. A subsequent call to --flush causes the log output to switch back to /var/log/journal/, see above.

-1

Journald limit (SystemMaxUse) puts a limit only on journald own files in /var/log/journal. It doesn't know or care about other log files. It's other applications responsibility.

4
  • And what is in those journal files then that is not in syslog?
    – flood
    Feb 17, 2023 at 21:24
  • I can't know which one of many thousand linux distros you have installed. I don't know which one of hundreds of services you have installed and running. There's zero information in your post. Journalctl works as intended in your case. Your question is answered. If you have a new question, please create it. There's no concept, you have logging applications other than systemd-journald. systemd-journald does NOT write to any files outside of /var/log/journal. Feb 17, 2023 at 22:18
  • The question was, what contains /var/log/journal. No reason to downvote. Thanks anyways
    – flood
    Feb 17, 2023 at 23:04
  • "what contains /var/log/journal" - I'm not sure I understand you. Feb 18, 2023 at 9:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .