2

I have a web and email server based on Arch Linux.

I have been trying for a long time to keep enough log entries in journal, but unfortunately it doesn't work. I have no problem with other servers.

Of course, I set up Storage = persistent and SystemMax(Use|KeepFree) options, but as if they were not working at all. After the settings I restarted the systemd-journald.

Remains approx. 2.3 Gb is the size of the journal directory, and every day (possibly twice) it deletes the old logging. The system disk is 206 Gb, of which 72 Gb is free. In the journal directory, 291 linux users have log files (each larger than 999 id, eg user-5002.journal), but all of them are the same size.

My settings:

[Journal]
Storage=persistent
#Compress=yes
#Seal=yes
#SplitMode=uid
#SyncIntervalSec=5m
#RateLimitIntervalSec=30s
#RateLimitBurst=10000
SystemMaxUse=99%
SystemKeepFree=2G
#SystemMaxFileSize=
#SystemMaxFiles=100
RuntimeMaxUse=99%
RuntimeKeepFree=1%
#RuntimeMaxFileSize=
#RuntimeMaxFiles=100
MaxRetentionSec=3month
MaxFileSec=3month
#ForwardToSyslog=no
#ForwardToKMsg=no
#ForwardToConsole=no
#ForwardToWall=yes
#TTYPath=/dev/console
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#MaxLevelWall=emerg
#LineMax=48K

List boots:

journalctl --list-boots

List logs:

journalctl
-- Logs begin at Sun 2019-01-27 08:15:40 CET, end at Tue 2019-02-12 14:24:32 CET. --

It is strange that from 01-27, the journal retained a few record pure-ftpd entries, it always remains, but then the beginning of journaling at this moment Feb 12 13:44:27 (the morning records were once deleted today). Most of the postfix is logged, it has a lot of traffic.

I would like to keep log entries for up to 3 months if the disk size allows. I don't know what to set up to do that at all.

Laszlo Malina
  • 168
  • 2
  • 10
  • Your configuration looks fine. Did you set up a cron job or something that empties the journal? – Michael Hampton Feb 12 '19 at 16:14
  • I haven't set up any programs or crontab. I checked it. Yes, I also feel the settings are fine. However, I set up SplitMode=none and then deleted all user-userid.journal files. The reservation was reduced from 2.3 GB to 48 MB. Now I'm waiting for the result. – Laszlo Malina Feb 12 '19 at 19:29
  • At this moment, there are still yesterday's journal entries. Reservation has increased to 352 MB. I'm thinking that many journal files could have caused the problem. The default value for SystemMaxFiles is 100, which is significantly exceeded. I can't explain why it can be affected, but since there is a single journal file, log entries have not been deleted ever since. – Laszlo Malina Feb 13 '19 at 16:50

0 Answers0