CentOS

Hello,

I want to configure journal to keep active log (eq. before rotation) at least one month. I made changes I believe it will keep the active log for one month. Single file is not bigger then 24MB.

So maybe some file size restriction but again I believe SystemMaxFileSize=1024 will keep log unless it will bigger than 1024MB. Rest of configuration is the default.

I made additional configuration file in /etc/systemd/journald.conf.d/

Here is my config.:
----
journald.conf.d]# cat main.conf
# Ansible managed

[Journal]
SystemMaxFileSize=1024
MaxFileSec=1month
----

I don't want to bother others but it is hard to play with when you have to wait one month to validate changes happened. So I will really appreciate someone with similar experience

Thanks in advance.

Marek

I looked at man journald.conf and the way I read that is that SystemMaxFileSize= is in bytes so perhaps not quite what you thought would happen.

SystemMaxFileSize= and RuntimeMaxFileSize= control how large individual journal files may grow at maximum. This
influences the granularity in which disk space is made available through rotation, i.e. deletion of historic
data. Defaults to one eighth of the values configured with SystemMaxUse= and RuntimeMaxUse=, so that usually
seven rotated journal files are kept as history. Specify values in bytes or use K, M, G, T, P, E as units for the
specified sizes (equal to 1024, 1024²,... bytes). Note that size limits are enforced synchronously when journal
files are extended, and no explicit rotation step triggered by time is needed.

Specifically the bit that says "Specify values in bytes" so I think the default is bytes and you've told it that each journal file should be 1024 bytes. There can be up to 8 of them (while rotation is in progress) so SystemMaxFileSize is 1/8th of the total space that could potentially be used.

Also, I may be stating the obvious, but you need to create the /var/log/journal directory to have the journals be persistent, otherwise they are kept in tmpfs and lost on reboot.

Thank you for the reply.

You are right with size values. But anyway actual log files are about 24M which is corresponding to 10% of the partition where log files are kept.
So it is looking for me like additional configuration is not considered.

With persistent journals I have no problem. It is working from default.

I will change the 1024 bytes and I hope it will work.

Please don't you have some experience with the similar configuration? I am afraid it will not work due to some bug or some additional specific setup which is not clear.

Best Regards,
Marek

With persistent journals I have no problem. It is working from default.

Then you did something different... or you mean that it just works once you create /var/log/journal? That directory doesn't exist by default and thus it uses tmpfs for the logfiles so they are not persistent over a reboot. The only thing you have to do to enable persistent logs is to create that directory.

Please don't you have some experience with the similar configuration? I am afraid it will not work due to some bug or some additional specific setup which is not clear.

No, never had the need to use journals. If you're worried about it then set up a VM and test there.

My apologies you are right about persistent logs they are in /run (I was checking the wrong server) but anyway I don't need them to persist after restart much more I need at least month of active log.

I can try this in VM but how I can simulate the month of activity? Maybe by changing the date in system but I am not sure about that.

Best regards,
Marek

If you need to simulate a month of activity then I suspect you will need to tweak the date on the VM (otherwise, see you in August..).

Finally, problem solved.

Due to the default configuration, logs are kept on volatile storage. In this case one is suppose to use RuntimeMaxFileSize= instead of SystemMaxFileSize=