I set up my journald to limit the log size to 5GB in
and thought everything was fine. Then, yesterday, I realized that my
/var/log/syslog file is in fact 12GB big.
What I believed was that
journalctl is reading the messages from different log locations, and that the
SystemMaxUse option is meant to limit their size. But as it seems, it is not.
I ended up using logrotate now with the size option but I would prefer to understand the concept for the future.
It looks like I have not really understood how the logs in
/var/log are entangled with journald/journalctl. Please enlighten me!