3

It happens on my production machines that there is so much logs that journalctl "freezes" the production webservers (by eating all IO). Yup, I'm logging a lot (~4GB compressed per 3-4 hours).

As my servers should earn money first and in free time do some logging, I would like to change the priority of journald (nice and ionice).

Why low priority for journal is not set by default in Debian? (for me it looks reasonable for all configurations) Are there any problems with such configuration? What is the best way to change the priority in Debian?

neutrinus
  • 1,125
  • 7
  • 18
  • 2
    generally it's maybe worth considering reducing logging on production server. second you may want to consider remote logging so remote box does intensive IO part, or in the end you may want to consider writing logs to local non-journaled FS if you think jounral is killing you. nice wont help with io related things and ionice won't help (do anything) unless you have right IO elevator (cfq) which is inferior to deadline e.g. – Hrvoje Špoljar Jan 22 '16 at 11:02
  • I do have a remote logging-server, we use journald as a backup log storage for short timeframe in case of emergency. As there is a lot of traffic (~800GB/day) so there is a lot of logs :) Thanks for suggestion that ionice would not help with standard IO elevator. It's not the FS-journal that's killing me, but systemd-journald. – neutrinus Jan 22 '16 at 11:24

1 Answers1

0

The right thing to do would be to remove /var/log/journal from webserver and use systemd-journal-upload to push logs to dedicated machine running systemd-journal-remote.

god
  • 232
  • 3
  • 10