I use journald with memory only logging limited to 55MB. But somehow this equates to less than a days worth of logging.
Config:
$ grep -v '^#' /etc/systemd/journald.conf
[Journal]
Storage=volatile
RuntimeMaxUse=50M
RuntimeKeepFree=75M
RuntimeMaxFileSize=5M
RuntimeMaxFiles=100
ForwardToSyslog=yes
MaxLevelSyslog=debugDisk usage:
$ journalctl --disk-usage
Archived and active journals take up 55.0M in the file system.The uncompressed size of the output of journalctl is 3.1M:
journalctl >logs; du -h logs
3.1M logsThe compressed size is 153K:
$ journalctl |gzip >logs.gz; du -h logs.gz
153K logs.gzUPDATE:Even when using journalctl -a -o verbose The output data uses half of what journald consumes:
$ journalctl -a -o verbose >foo; df -h foo
27M fooAnd it compresses to a 50th of what journald consumes:
$ journalctl -a -o verbose |gzip >foo.z; du -h foo.z
1.7M foo.zEND UPDATE
The journals are healthy according to journalctl --verify:
$ journalctl --verify
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/
$ ls -alh /run/log/journal/69357476ee55415c8407fc9f84dc235d/
total 55M
drwxr-s---+ 2 root systemd-journal 260 Jul 27 11:53 .
drwxr-sr-x 3 root systemd-journal 60 Jul 26 15:42 ..
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 02:08
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 03:13
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 04:18
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 05:23
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 06:28
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 07:33
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 08:38
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 09:43
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 10:48
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 11:53
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 12:18 system.journalSo why and how does journald use 359 times more space to store what compresses easily to 153K?
What's taking up 99.8% of the space, and is there a way to store more data at the cost of whatever that 99.8% is?
5 Reset to default