On Tue, Dec 20, 2016 at 12:29 PM, ianseeks
Why did I disable the journal on disk (temporary and long term)? Because it takes gigabytes...
I have an nntp local server (proxy), and it produces tons of log messages per day. With syslog I can dump them all after, say, a week. With journal, I can't. If I want to keep a reasonable long term journal of all important events in my machine, it also keeps the useless debug logs of everything else... I can not purge the database of selected content.
Are you sure about that?
Yes.
There are loads of configuration options in journald.conf regarding storage and storage sizes and retention times
If you take time to actually read about these configuration options you will see that they refer to total size or retention time of *all* journal entries. So you can trivially cause mild DoS by simply filling logs with garbage, thus causing important entries to be displaced out of journal. Syslog allows filtering of logs into different places for long term storage and you can configure individual retention rules for each (although that is strictly speaking unrelated to syslog). Systemd author is actively opposed to any idea to filter log entries in journald. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org