Just some ramblings about systemd-journald, without enabling persistent logging, seems the thing is somewhat crippled, use of what'd be available with "journalctl" commands and variations with logging not being retained must impair any possible use of the thing. So I did so, after creating a journal directory in /var/log for it to use, adding my user to the appropriate group to be able to check the journal's contents, then editing the default config file at /etc/systemd/journald.conf to add persistence to the thing, however it's defaults seem weird and wasteful to me, based on what I was seeing while researching the thing. ie: By default it'll use up to 10% of the disk space on the root directory up to like 4gbs. Four gigabytes is way too much, I don't reasonably need to retain info from the last 6,000 boots etc. Personally set this to allow it all of 24mbs of disk to use and still get data from 10 or more previous boots. Check the output of "journalctl --disk-usage" and it still tends to stay a bit over what I've set but not too much (like 8mbs)and I certainly don't need 4gbs of disk devoted to this function.
Also someone can change the logging levels, what gets logged in the journald.conf file. I don't want tons of trash that could never be of interest to me, only want emergency, critical, error and warnings even logged. Otherwise it's just a bunch of extra junk to dig through, more wasted disk i/o for data I don't need. So changed these at the bottom of the journald.conf file to being ...
So that only warnings or more serious errors are even logged. You of course have to set these yourself in journald.conf and uncomment the line(s)in the file for them to override defaults. Anyway ... wanted to share this random junk I've learned. Perhaps somebody has additional info to share on the topic or input on it and tweaking it ? Tell the truth I cannot recall a time when I was experiencing problems in which checking system logs played a meaningful role in diagnosing/fixing things but may just not recall an incident too. So now we've got redundant logging too with rsyslog running. Uses so little in terms of resources, not even bothering messing with it.
If it doesn't relate to Debian, but you still want to share it, please do it here
1 post • Page 1 of 1