Saturday, June 13, 2015

reasonable startup log (journald) sizing

Prior to systemd, boot-ups used to log to /var/log, pretty much auto-magically via rsyslog (syslog). The only thing one had to configure was chron's timeline for rotating old logs into the trash. Suckily, journald logs grow until they take over something like 10% of disk space by default. To me, it's yet another mistake of the last 8 years of Linux -- adding boggy new application layers instead of improving and simplifying long-standing daemons1. At any rate, journald must be configured if you want anything reasonable and intelligible. Secondly, you must use "journalctl" the read them, because they are stored in a binary format.

Since there are about 30 settings in /etc/systemd/journald.conf, you'll have to waste something like an hour researching journald's settings. At the end, this is /etc/systemd/journald.conf when I'm troubleshooting.
When I want an ASCII record for grepping, etc, I use journalctl -r -o short-iso ("r" reverses time to put most recent on top, "short-iso" is for giving normal clock timestamps), and save screen output to text:
$ journalctl -r -o short-iso 2>&1 file.txt
Alternatively, one can output other formats such as the apparently standard JSON format. It cannot however export directly to text unless it's to another application.

This the file when the system is running well and no logging is needed:


  • 200K of logging seems to cover about the last 10 boots.
  • journalctl --verify checks logs for corruption

1It's as stupid as when PulseAudio took hold of Alsa (which itself overlaid OSS)

No comments: