Why does journald use so much space to store so little data, and how can I reduce or compress the journal logs?

I use journald with memory only logging limited to 55MB. But somehow this equates to less than a days worth of logging.

Config:

$ grep -v '^#' /etc/systemd/journald.conf
[Journal]
Storage=volatile
RuntimeMaxUse=50M
RuntimeKeepFree=75M
RuntimeMaxFileSize=5M
RuntimeMaxFiles=100
ForwardToSyslog=yes
MaxLevelSyslog=debug

Disk usage:

$ journalctl --disk-usage
Archived and active journals take up 55.0M in the file system.

The uncompressed size of the output of journalctl is 3.1M:

journalctl >logs; du -h logs
3.1M logs

The compressed size is 153K:

$ journalctl |gzip >logs.gz; du -h logs.gz
153K logs.gz

UPDATE:Even when using journalctl -a -o verbose The output data uses half of what journald consumes:

$ journalctl -a -o verbose >foo; df -h foo
27M foo

And it compresses to a 50th of what journald consumes:

$ journalctl -a -o verbose |gzip >foo.z; du -h foo.z
1.7M foo.z

END UPDATE

The journals are healthy according to journalctl --verify:

$ journalctl --verify
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
$ ls -alh /run/log/journal/69357476ee55415c8407fc9f84dc235d/
total 55M
drwxr-s---+ 2 root systemd-journal 260 Jul 27 11:53 .
drwxr-sr-x 3 root systemd-journal 60 Jul 26 15:42 ..
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 02:08
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 03:13
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 04:18
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 05:23
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 06:28
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 07:33
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 08:38
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 09:43
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 10:48
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 11:53
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 12:18 system.journal

So why and how does journald use 359 times more space to store what compresses easily to 153K?

What's taking up 99.8% of the space, and is there a way to store more data at the cost of whatever that 99.8% is?

5 Reset to default

Know someone who can answer? Share a link to this question via email, Twitter, or Facebook.

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password

Post as a guest

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

You Might Also Like