Dear Nikolaus,
Am 14.11.20 um 10:31 schrieb Nikolaus Rath:
I just discovered that on one of my systems journald only retains log
entries for about 10 days:
# journalctl | head -1
-- Logs begin at Wed 2020-11-04 15:57:13 UTC, end at Sat 2020-11-14 09:28:19 UTC. --
I do not understand what could cause this, because I have no retention
limit configured, and the logs take up way less space than I have
reserved:
# journalctl --disk-usage
Archived and active journals take up 320.0M in the file system.
# journalctl > alllogs
# ls -lh alllogs
-rw-r--r-- 1 root root 27M Nov 14 09:24 alllogs
What size does adding the switch `-a` result in? From journalctl(1):
-a, --all
Show all fields in full, even if they include unprintable
characters or are very long. By default, fields with unprintable
characters are abbreviated as "blob data". (Note that the pager may
escape unprintable characters again.)
Can someone help me understand where the log entries have gone?
# journalctl --version
systemd 241 (241)
+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN -PCRE2 default-hierarchy=hybrid
# grep -vE '^#' /etc/systemd/journald.conf
[Journal]
SystemMaxUse=300M
The number shown by disk usage (320 MB) is higher than 300 MB. Maybe
also check the files in `/var/log/journal`.
Kind regards,
Paul
_______________________________________________
systemd-devel mailing list
systemd-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/systemd-devel
