1

I have an issue with journalctl, I set it to use 100M maximum in my journald.conf:

[Journal]
Compress=yes
SyncIntervalSec=5m
SystemMaxUse=100M
ForwardToSyslog=no
ForwardToKMsg=no
ForwardToConsole=no
ForwardToWall=yes
LineMax=48K
ReadKMsg=yes

Which for some reason gives me only 2 days of logs. When I run journalctl --disk-usage it shows:

$ sudo journalctl --disk-usage
Archived and active journals take up 106.0M in the file system.

However, when I run journalctl | wc -c, it shows there is only 7MB of logs:

$ sudo journalctl | wc -c
7429593

Why is journalctl only giving 7MB of logs (2 days) while using 106MB? Where is the extra space going?

Roman Gaufman
  • 73
  • 7
  • can you check journal log location I hope you are doing archiving. – asktyagi Jul 14 '19 at 04:26
  • I am, the archives are in /var/log/journal/4978883f003443d9a028798e7f5a40a4 and that takes up 107MB, but sudo journalctl -a doesn't seem to be accessing those archives. – Roman Gaufman Jul 14 '19 at 11:55

2 Answers2

0

If you check output Archived and active journals take up 106.0M in the file system. mean it include archived logs too. Check below location you come to know exact size of total journal logs

# ls -lthr /run/log/journal/<id>/
total 544M
-rw-r-----+ 1 root systemd-journal 32M Jun 25 19:13 system@<some id>.journal
-rw-r-----+ 1 root systemd-journal 40M Jun 27 04:00 system@<some id>.journal
-rw-r-----+ 1 root systemd-journal 40M Jun 28 14:38 system@<some id>.journal
-rw-r-----+ 1 root systemd-journal 40M Jun 30 01:16 system@<some id>.journal
-rw-r-----+ 1 root systemd-journal 40M Jul  1 11:56 system@<some id>.journal
-rw-r-----+ 1 root systemd-journal 40M Jul  2 22:36 system@<some id>.journal
-rw-r-----+ 1 root systemd-journal 40M Jul  4 09:10 system@<some id>.journal
-rw-r-----+ 1 root systemd-journal 40M Jul  5 19:48 system@<some id>.journal
-rw-r-----+ 1 root systemd-journal 40M Jul  7 06:20 system@<some id>.journal
-rw-r-----+ 1 root systemd-journal 40M Jul  8 17:00 system@<some id>.journal
-rw-r-----+ 1 root systemd-journal 40M Jul 10 03:42 system@<some id>.journal
-rw-r-----+ 1 root systemd-journal 40M Jul 11 14:20 system@<some id>.journal
-rw-r-----+ 1 root systemd-journal 40M Jul 13 00:59 system@<some id>.journal
-rw-r-----+ 1 root systemd-journal 32M Jul 14 04:31 system.journal
asktyagi
  • 2,860
  • 2
  • 8
  • 25
  • Yes, I can see that if I do du -sm /var/log/journal/4978883f003443d9a028798e7f5a40a4, that shows 107MB. But my understanding was that sudo journalctl -a should show archived logs as well? -- if not, how do I access the archived logs? – Roman Gaufman Jul 14 '19 at 11:54
  • use like this `journalctl --since "2019-07-01" --until "2019-07-010 03:00"` to get msg between specific time. – asktyagi Jul 15 '19 at 02:50
  • I don't, I only get the last 2 days which amounts to around 7MB of the 107MB of logs. That's the question :( – Roman Gaufman Jul 16 '19 at 06:41
0

Default --output=short does not show all of the fields. Including fairly large boot ID and timestamps with every entry.

--output=export is not exactly like the on disk format, as lots of text with name=value. However, as a serialization stream it is closer to the real size.

# journalctl --disk-usage
Archived and active journals take up 56.0M on disk.
# journalctl | wc -c
5420238
# journalctl -o export | wc -c
34683172

The remainder I am not entirely sure. Journal file format spec mentions everything is padded to 64 bit alignment. Possibly metadata like array and tag objects also take up space.

John Mahowald
  • 32,050
  • 2
  • 19
  • 34
  • I tried on another machine and there I am seeing journalctl -o export is giving 44MB uncompressed while --disk-usage still shows 106M compressed (same size when I do du -sm /var/log/journal/4978883f003443d9a028798e7f5a40a4), so there seems to be a huge unexplained discrepancy hmm. – Roman Gaufman Jul 14 '19 at 11:52