Re: [systemd-devel] Antw: [EXT] Re: [systemd‑devel] MaxRetentionSec does not delete entries older than the specified time

[baba]

- Mail original -
De: "Ulrich Windl" 

> From the header (in your original message) it was obvious that all the dates
> displayed were covered by a single file.
> So that file cannot be deleted without deleting everything. Obvious?

Yes it is.

[systemd-devel] Antw: [EXT] Re: [systemd‑devel] MaxRetentionSec does not delete entries older than the specified time

[Ulrich Windl]

>>> Barry Scott  schrieb am 29.05.2022 um 14:22 in
Nachricht <038e8fce-5820-4188-91e4-e42b6b448...@barrys-emacs.org>:

> 
>> On 29 May 2022, at 12:36, baba  wrote:
>> 
>> ‑ Mail original ‑
>> De: "Andrei Borzenkov" 
>> 
>>> In which case? Current active journal file gets archived when it is
>>> full. Retention policies apply only to these archived files.
>> 
>> In the case where MaxRetentionSec=3day.
>> And what do you mean by full?.

>From the header (in your original message) it was obvious that all the dates
displayed were covered by a single file.
So that file cannot be deleted without deleting everything. Obvious?


>> 
> 
> There are size limits on the journal files. I think that is what is being 
> referred to.
> See man journald.conf and the SystemMaxFileSize for example.
> 
> Barry

Re: [systemd-devel] MaxRetentionSec does not delete entries older than the specified time

[baba]

- Mail original -
De: "Barry Scott" 

> There are size limits on the journal files. I think that is what is being 
> referred to.
> See man journald.conf and the SystemMaxFileSize for example.

Ok, thanks for the explanation.

Re: [systemd-devel] MaxRetentionSec does not delete entries older than the specified time

[Barry Scott]

> On 29 May 2022, at 12:36, baba  wrote:
> 
> - Mail original -
> De: "Andrei Borzenkov" 
> 
>> In which case? Current active journal file gets archived when it is
>> full. Retention policies apply only to these archived files.
> 
> In the case where MaxRetentionSec=3day.
> And what do you mean by full?.
> 

There are size limits on the journal files. I think that is what is being 
referred to.
See man journald.conf and the SystemMaxFileSize for example.

Barry

Re: [systemd-devel] MaxRetentionSec does not delete entries older than the specified time

[baba]

- Mail original -
De: "Andrei Borzenkov" 

> In which case? Current active journal file gets archived when it is
> full. Retention policies apply only to these archived files.

In the case where MaxRetentionSec=3day.
And what do you mean by full?.

Re: [systemd-devel] MaxRetentionSec does not delete entries older than the specified time

[Andrei Borzenkov]

On 29.05.2022 12:04, baba wrote:
> In my /etc/systemd/journald.conf, I have:
> Storage=persistent
> MaxRetentionSec=3day
> 
> And it doesn't delete entries older that 3 days:
> 

Retention does not delete *entries*. It deletes archived journal files.

...

> 
> In this case is the journal daemon automatically archive active journal files 
> or 
> I need to do it manually with the --rotate option?

In which case? Current active journal file gets archived when it is
full. Retention policies apply only to these archived files.

Of course you can force rotation manually if you need.

[systemd-devel] MaxRetentionSec does not delete entries older than the specified time

[baba]

In my /etc/systemd/journald.conf, I have:
Storage=persistent
MaxRetentionSec=3day

And it doesn't delete entries older that 3 days:

root@debian:/# systemctl restart systemd-journald

root@debian:/# journalctl --list-boots
-9 0807bb3315184888be3798d45e31ea32 Sun 2022-05-22 16:02:11 CEST—Sun 2022-05-22 
16:05:45 CEST
-8 9d548fcf0b144b27a8d485bb105630e5 Mon 2022-05-23 09:02:45 CEST—Mon 2022-05-23 
09:12:33 CEST
-7 3fa67c43fd2c4600908caea9860d7a65 Tue 2022-05-24 09:55:35 CEST—Tue 2022-05-24 
10:15:58 CEST
-6 c8d68dbb714241d8bee1464addeecad7 Wed 2022-05-25 08:55:28 CEST—Wed 2022-05-25 
09:28:03 CEST
-5 13802d3466cc4c3d85489976d74e747f Thu 2022-05-26 09:05:08 CEST—Thu 2022-05-26 
09:19:55 CEST
-4 dd2da032a67442399c6efe1dc7558029 Fri 2022-05-27 15:59:25 CEST—Fri 2022-05-27 
16:11:34 CEST
-3 529fe4b637f7464a83ffeb2b711f6586 Sat 2022-05-28 09:39:26 CEST—Sat 2022-05-28 
10:09:54 CEST
-2 ae65829905774e73959ac5e0d31642f2 Sat 2022-05-28 12:46:21 CEST—Sat 2022-05-28 
12:46:48 CEST
-1 c1562081403c4d589b28493665982de5 Sun 2022-05-29 10:21:13 CEST—Sun 2022-05-29 
10:36:49 CEST
 0 01c8092b3cec4d499c78ac8f026a9cb8 Sun 2022-05-29 10:37:10 CEST—Sun 2022-05-29 
10:38:24 CEST
 
root@debian:/# journalctl --header
File path: /var/log/journal/ac27c4f71b94428396fc1096906bddb6/user-1000.journal
File ID: 97546f4eb6d141f38e2de316361b49fb
Machine ID: ac27c4f71b94428396fc1096906bddb6
Boot ID: 01c8092b3cec4d499c78ac8f026a9cb8
Sequential number ID: 5b7e6cd7b7a6448691bea6ae5b4153e1
State: ONLINE
Compatible flags:
Incompatible flags: COMPRESSED-ZSTD KEYED-HASH
Header size: 256
Arena size: 8388352
Data hash table size: 233016
Field hash table size: 333
Rotate suggested: no
Head sequential number: 55160 (d778)
Tail sequential number: 69575 (10fc7)
Head realtime timestamp: Sun 2022-05-22 16:02:11 CEST (5df9a2b839bee)
Tail realtime timestamp: Sun 2022-05-29 10:38:24 CEST (5e02276772791)
Tail monotonic timestamp: 1min 17.890s (4a484e5)
Objects: 3038
Entry objects: 591
Data objects: 1375
Data hash table fill: 0,6%
Field objects: 42
Field hash table fill: 12,6%
Tag objects: 0
Entry array objects: 1028
Deepest field hash chain: 1
Deepest data hash chain: 1
Disk usage: 8.0M

File path: /var/log/journal/ac27c4f71b94428396fc1096906bddb6/system.journal
File ID: 0810c8f89f70454296c6bf5a57e00022
Machine ID: ac27c4f71b94428396fc1096906bddb6
Boot ID: 01c8092b3cec4d499c78ac8f026a9cb8
Sequential number ID: a3632c9bcac24d45a1085c630e4d0571
State: ONLINE
Compatible flags:
Incompatible flags: COMPRESSED-ZSTD KEYED-HASH
Header size: 256
Arena size: 16776960
Data hash table size: 233016
Field hash table size: 333
Rotate suggested: no
Head sequential number: 55157 (d775)
Tail sequential number: 69570 (10fc2)
Head realtime timestamp: Sun 2022-05-22 16:02:11 CEST (5df9a2b8205a2)
Tail realtime timestamp: Sun 2022-05-29 10:37:41 CEST (5e02273e678bd)
Tail monotonic timestamp: 34.854s (213d611)
Objects: 39598
Entry objects: 13828
Data objects: 17899
Data hash table fill: 7,7%
Field objects: 77
Field hash table fill: 23,1%
Tag objects: 0
Entry array objects: 7792
Deepest field hash chain: 2
Deepest data hash chain: 2
Disk usage: 16.0M

In this case is the journal daemon automatically archive active journal files 
or 
I need to do it manually with the --rotate option?