04.03.2016 00:47, Carlos E. R. пишет:
On 2016-03-03 18:46, Andrei Borzenkov wrote:
No. Journald explicitly does not do filtering.
Does it allow purging entries from the database? Like doing a "logrotate".
There is MaxRetentionSec which is roughly analogous to logrotate time-based retention and *MaxUse and *MaxFiles that are roughly analogous to logrotate size-based retention.
What you can do is disable storage and use it only for multiplexing:
Storage=none
"none" turns off all storage, all log data received will be dropped. Forwarding to other targets, such as the console, the kernel log buffer, or a syslog socket will still work however. Defaults to "auto".
Yes, I found that one, but seemed not to work.
That would be a bug.
Now I'm using:
[Journal] #CER #Storage=none SystemMaxUse=100M RuntimeMaxUse=50M MaxLevelStore=notice
which drastically reduced the content in the journal. Previously the size limit was not honoured, it started working half an hour ago.
All limits apply to archived journal files. It means if you have large files that being actively used they can well go over limit. I won't claim to understand in details how journald manages its storage.