Re: limiting the (systemd) journal size

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On Tue, Sep 27, 2022, at 10:38 AM, Gregory Bartholomew wrote:
> FWIW (probably not much), I have run into an issue with regard to the 
> default journal size being too large on Fedora Server when running a 
> bunch of systemd-nspawn containers each with sshd and fail2ban enabled. 
> When I reboot a bunch of the containers at once (or the whole 
> hypervisor), fail2ban really seemed to bog things down and use a lot of 
> CPU time (re)scanning the journals for failed ssh attempts to (re)ban 
> the IP addresses. In my case, I worked around the issue with the 
> following. The real problem might be with my fail2ban configuration or 
> something else. But it might be something to consider when thinking 
> about what would be a good size/time limit for the journal.
>
> # cat /etc/systemd/system/fail2ban.service.d/override.conf 
> [Service]
> ExecStartPre=/usr/bin/journalctl --vacuum-time=1months

What about modifying /etc/systemd/journald.conf:

MaxFileSec=1week
MaxRetentionSec=5week

This should result in at least 4 weeks of journal entries, i.e. it would delete a journal file once entries reach 5 weeks old, but since the journal files are rotated weekly, it should mean a given journal file won't have more than a week's worth of entries. So you'd have between 4-5 weeks worth of entries at any given time.

-- 
Chris Murphy
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Users]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]

  Powered by Linux