On Sat, Nov 14, 2020 at 11:31 AM Nikolaus Rath <Nikolaus@xxxxxxxx> wrote:
Hello,
I just discovered that on one of my systems journald only retains log
entries for about 10 days:
# journalctl | head -1
-- Logs begin at Wed 2020-11-04 15:57:13 UTC, end at Sat 2020-11-14 09:28:19 UTC. --
I do not understand what could cause this, because I have no retention
limit configured, and the logs take up way less space than I have
reserved:
# journalctl --disk-usage
Archived and active journals take up 320.0M in the file system.
# journalctl > alllogs
# ls -lh alllogs
-rw-r--r-- 1 root root 27M Nov 14 09:24 alllogs
That just shows the 'MESSAGE' field -- it does not show any other fields that each entry will have stored, such as the unit name which generated the message; the program's command line; and apparently even the original unparsed packet that was received through /dev/log. Try `journalctl -o export` to get a closer idea of what the messages in systemd-journal look like.
For example, on one of my servers, a plain `journalctl -a` outputs 260 MB of data, but `journalctl -o export` is 1.9 GB. (Which is still not quite the same as 2.4 GB of *.journal files, but there's always going to be some discrepancy due to how a binary database allocates space.)
Mantas Mikulėnas
_______________________________________________ systemd-devel mailing list systemd-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/systemd-devel
