On Mon, Mar 6, 2017 at 11:26 AM, Stefan Seyfried
susi:~ # journalctl --disk-usage Archived and active journals take up 792.6M in the file system. susi:~ # time journalctl -m | wc -c 5061219
real 0m1,724s user 0m1,696s sys 0m0,448s
That's 790MB for 3 weeks worth of logs.
susi:~ # du -sh /var/log/journal/ /var/log/ 793M /var/log/journal/ 101M /var/log/
So everything else (including 20MB YaST2 ~25MB zypp/zypper etc) takes 101M for 1year+ of logs, and journal takes almost 800MB for 3 weeks.
I'm very impressed.
journal collects a lot of metadata associated with log entry, so for each line in syslog we get rather more in journal. You can compare "journalctl -o short" and "journalctl -o verbose"
My interpretation is that it has to read, decompress, and sort.
Compression is probably done per record, not per file. And only the text. I hope.
Well, it looks like the compression is not very effective... :-)
Only actual payload exceeding threshold is compressed, not metadata. I believe threshold is 512 bytes, so small lines are stored as is. I suspect compression was more related to storing coredumps. Oh, BTW, coredumps may go into journal (I am not sure what are default settings). -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org