Periodically switch volatile to persistent journald and vice versa

[Renjaya Raga Zenta <renjaya.zenta@xxxxxxxxxxxxxxx>]

Hi,

We have custom embedded device using SD Card as the main storage.
I think there are some concerns regarding how journald write the
logs, that may cause massive write amplification and that's bad for
a standard SD Card.

Journald has Storage= option, I could use Storage=volatile and
ForwardToSyslog=yes then the disk writes seems acceptable. I could still do
systemctl status and journalctl, but the logs won't be available the
next reboot.

Journalctl has --flush command, to flush any log data stored in
/run/log/journal/ into /var/log/journal/. It also has --relinquish-var
command, to do the reverse operation of --flush.

Correct me if I'm wrong, if I do journalctl --flush, journald will write
in bulk, isn't it? So the write amplification has less effect. If it's
true, then I think periodically switching journald storage may help.

1. First, I set Storage=volatile
2. After a while, I change it to Storage=persistent or Storage=auto,
then journalctl --flush (is restarting systemd-journald necessary?)
3. Then, I change it again to Storage=volatile and journalctl
--relinquish-var (again, is restarting systemd-journald required?).

So, is this a good approach? Or is my assumption is wrong. Please kindly
advise.

If it isn't wrong, the next question is when should I switch from /run to
/var? The /run is using tmpfs, so it's in memory. I need to do the
switch before the journal log size in /run up to 50 MB for example. How
to do that?


Thank you.