I am migrating to systemd/journald (via an upgrade from Debian wheezy to jessie) and I've come across a problem migrating that is peculiar to my setup.
I currently have /var/log on an SSD. I also have some noisy logs. In attempt to not have rsyslog write continuously to the SSD, I have set up some syslog facilities and special filters to log to /run/log files instead of /var/log for those noise logs. I have an hourly cron job that runs logrotate on the /run/log files and appends the rotated log (the .1 file) to the persistent logs in /var/log. I would like to be able to do something similar with journald. The specifics of my logging that is temporarily volatile is captured in these rsyslog configs: local1.* /tmp/log/dnsmasq.log local4.* /tmp/log/ldap.log if $syslogfacility-text == 'kern' and $msg contains 'firewall:' then /tmp/log/firewall.log I am aware that on an unclean shutdown these logs get lost. I am ok with that. They are mostly useful for realtime debugging and not historical analysis. In the rare event of an unclean shutdown, I accept this loss (I've not yet had such a shutdown). Is there a way to configure journald to do something similar? Is there some other mechanism that can address excessive log writing to an SSD? _______________________________________________ systemd-devel mailing list systemd-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/systemd-devel