On Thu, 23.10.14 17:19, D.S. Ljungmark (spi...@aanstoot.se) wrote: > > > On 23/10/14 16:50, Lennart Poettering wrote: > > On Thu, 23.10.14 15:27, D.S. Ljungmark (spi...@aanstoot.se) wrote: > > > >> Hi, > >> we have a few services that are spamming a fair bit on DEBUG level of > >> log output. In syslog, we'd separate the DEBUG logs from the main log, > >> and set the rotation of DEBUG+ to be ~24 hours, while keeping INFO and > >> above for ~4 weeks. > >> > >> How can we do something similar with Journald? > > > > No, currenty you cannot. You can turn off storage from a certain log > > level on (MaxLevelStore=), but you cannot change the retention time > > per log level yet. > > So if we set MaxLevelStore=INFO, we won't get the journal on disk > stored. How much is stored in memory and how do you control that > amount?
MaxLevelStore= controls what hits /run+/var, it makes not distinction there. If you set MaxLevelStore= then this means debug messages get dropped entirely. > Right now, we don't store anything to disk ( no persistent disk in the > system ) and why we're asking is that our DEBUG logs flushed the errors > & warnings from last night, and we have no idea what actually went > wrong. Before this, we were storing things (syslogd) but after > migrating to journald, we didn't figure out how to get them saved > properly, so it's been punted onto the very long TODO list by us as well. > > > Can I get a journal of ~50M (compressed?) stored on disk with Info and > above levels, and then another 50M of debug+above in RAM? Nope, this is currently not supported, but support a scheme like this is on the TODO list. Lennart -- Lennart Poettering, Red Hat _______________________________________________ systemd-devel mailing list systemd-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/systemd-devel
