On Sat, Nov 14, 2020, 20:17 Mantas Mikulėnas <grawity@xxxxxxxxx> wrote:
On Sat, Nov 14, 2020 at 11:31 AM Nikolaus Rath <Nikolaus@xxxxxxxx> wrote:Hello,
I just discovered that on one of my systems journald only retains log
entries for about 10 days:
# journalctl | head -1
-- Logs begin at Wed 2020-11-04 15:57:13 UTC, end at Sat 2020-11-14 09:28:19 UTC. --
I do not understand what could cause this, because I have no retention
limit configured, and the logs take up way less space than I have
reserved:
# journalctl --disk-usage
Archived and active journals take up 320.0M in the file system.
# journalctl > alllogs
# ls -lh alllogs
-rw-r--r-- 1 root root 27M Nov 14 09:24 alllogsThat just shows the 'MESSAGE' field -- it does not show any other fields that each entry will have stored, such as the unit name which generated the message; the program's command line; and apparently even the original unparsed packet that was received through /dev/log. Try `journalctl -o export` to get a closer idea of what the messages in systemd-journal look like.For example, on one of my servers, a plain `journalctl -a` outputs 260 MB of data, but `journalctl -o export` is 1.9 GB. (Which is still not quite the same as 2.4 GB of *.journal files, but there's always going to be some discrepancy due to how a binary database allocates space.)
One specific reason is that journal files are indexed – you can search them by any field value, without needing to do a full linear grep. (This is how "systemctl status" shows just one unit's logs, for example.) The indexes are stored along with the data, so the .journal files will be larger than the corresponding "-o export" dump.
_______________________________________________ systemd-devel mailing list systemd-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/systemd-devel
