On 2018-05-22 20:14, Per Jessen wrote:
Patrick Shanahan wrote:
* Carlos E. R. <robin.listas@telefonica.net> [05-22-18 11:15]:
On 2018-05-22 16:14, Patrick Shanahan wrote:
* Per Jessen <> [05-22-18 09:24]:
[...]
I did test it before I wrote my reply, if you stop journald, rsyslog and syslog-ng both stop logging.
Anyway, if you don't want journald writing to disk, but you still want syslog working, use "storage=volatile" and "forwardtosyslog=yes" in /etc/systemd/journald.conf
I accomplish nearly the same by setting SystemMaxUse=5 and ForwardToSyslog=yes
Still, entries are written to both places, that's some i/o load.
On my main machine I limit its disk space load, with the result that now the boot entries have been purged out (no permanent journal). On my server machine I left it on with ample space, for testing what would happen:
cer@Isengard:~> journalctl --disk-usage Archived and active journals take up 2.0G on disk. cer@Isengard:~>
The syslog files use 269 MB, much less and probably several months more of logs.
14:02 Crash:~ > journalctl --disk-usage Archived and active journals take up 2.5M in the file system.
It all depends on much activity the system has. A busy mailserver will be logging more etc.
hardly any activity: test422:~ # journalctl --disk-usage Archived and active journals take up 49.4M on disk. test422:~ # uptime 20:12pm up 57 days 2:53, 1 user, load average: 0.13, 0.04, 0.01
much busier: jensen:~ # journalctl --disk-usage Archived and active journals take up 408.0M in the file system. jensen:~ # uptime 20:13:37 up 32 days 6:34, 2 users, load average: 0.30, 5.01, 30.89
The machine with the 2 GB journal (default settings) has a big disk usage because it is almost one year of logs. On my desktop machine I only have one boot, no permanent journal, but they get purged fast because leafnode (nntp proxy server) talks a lot. So now there are no entries from boot after just 10 days of use. -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" at Telcontar)