|
In the syslogd configuration, you can arrange to have specific retention factors for a given class of information.
AKA, I can have all kernel messages go to a specific file and that file can have a retention/rotation specified by size or date
For example, I can ensure I have 90 days of data for 'authpriv' level syslog data, if audit requires it. And that data would ONLY include 'authpriv' level data.
I don't see any options in journald to limit the scope for 'system' journal data, when configured to be persistent.
Are there any configuration options (or options in plan for the future) that will allow me to split this level of data into different managed storage with its own retention polices, much like how syslogd currently allows?
The long term goal in this case is to deprecate syslogd for audit record retention (among other uses).
Scott Fields Kyndryl Senior Lead SRE – BNSF 817-593-5038 (BNSF)
|
journal: question regarding retention options by priority/identifier/unit
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
- Subject: journal: question regarding retention options by priority/identifier/unit
- From: SCOTT FIELDS <Scott.Fields@xxxxxxxxxxx>
- Date: Sun, 11 Aug 2024 21:42:39 +0000
- Accept-language: en-US
- Msip_labels:
- Follow-Ups:
- Prev by Date: systemd-measure in cross compile environment, and measured-uki vs tpm2 in ConditionSecurity?
- Next by Date: Re: journal: question regarding retention options by priority/identifier/unit
- Previous by thread: systemd-measure in cross compile environment, and measured-uki vs tpm2 in ConditionSecurity?
- Next by thread: Re: journal: question regarding retention options by priority/identifier/unit
- Index(es):
 |