On 2016-12-20 12:58, ianseeks wrote:
On Tuesday, 20 December 2016 14:24:08 GMT Andrei Borzenkov wrote:
I don't understand how it can displace important entries from the journal. As far as i know, it continues into a new file once it reaches its limit.
You can journalctl --vacuum-time=xmonths/days any redundant journal files away once you have dealt with them.
Syslog allows filtering of logs into different places for long term storage and you can configure individual retention rules for each (although that is strictly speaking unrelated to syslog).
Systemd author is actively opposed to any idea to filter log entries in journald.
I admit my knowledge on the journal is not great and this is why i ask questions to hopefully get the answers
Yes, you don't understand. Say that I have to keep logs of events for a year or two. This is not rare (you can be mandated for legal reasons). Yes, I can configure journal to do this, no problem so far. Now, journal keeps *all* entries of *everything*. That is the problem. Suppose I have a service that talks a lot, debug entries. Say nntp, for instance. I'm only interested in a week of those, for instance. But journal does not allow me to keep a week and delete the rest, while keeping mail log for two years. This nntp service may write to the log, for instance, ten megabytes of entries per day. On a year, that is 3650 megabytes (I have seen my journal have two gigabytes after an uptime of a month). If I limit the size of the log to a reasonable size, say a hundred megabytes, the log will be full of nntp entries and little else. It will be difficult to investigate a crash or a reboot that happened two weeks ago because due to the amount of entries from nntp, it keeps less than ten days. The solution is to *erase* all debug entries from nntp older than a week, say. But journal does not allow this, and the developer refuses to do it. So no, journal is not useful to me, I have to keep syslog. Yes, I know how to do it and I do. On some machines I keep both, on some only syslog. -- Cheers/Saludos Carlos E. R. (testing openSUSE Leap 42.2, at Minas-Anor) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org