On Sat, Nov 14, 2020 at 11:31 AM Nikolaus Rath <nikol...@rath.org> wrote:
> Hello, > > I just discovered that on one of my systems journald only retains log > entries for about 10 days: > > # journalctl | head -1 > -- Logs begin at Wed 2020-11-04 15:57:13 UTC, end at Sat 2020-11-14 > 09:28:19 UTC. -- > > I do not understand what could cause this, because I have no retention > limit configured, and the logs take up way less space than I have > reserved: > > # journalctl --disk-usage > Archived and active journals take up 320.0M in the file system. > > # journalctl > alllogs > # ls -lh alllogs > -rw-r--r-- 1 root root 27M Nov 14 09:24 alllogs > That just shows the 'MESSAGE' field -- it does not show any other fields that each entry will have stored, such as the unit name which generated the message; the program's command line; and apparently even the original unparsed packet that was received through /dev/log. Try `journalctl -o export` to get a closer idea of what the messages in systemd-journal look like. For example, on one of my servers, a plain `journalctl -a` outputs 260 MB of data, but `journalctl -o export` is 1.9 GB. (Which is still not quite the same as 2.4 GB of *.journal files, but there's always going to be some discrepancy due to how a binary database allocates space.) -- Mantas Mikulėnas
_______________________________________________ systemd-devel mailing list systemd-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/systemd-devel