Bug#773538: systemd: journal is quite big compared to rsyslog output

[Martin Steigerwald]

Package: systemd
Version: 218-2
Severity: normal

Dear Maintainer,

I have this here:

merkaba:~> du -sch /var/log/* | sort -rh | head -10
1,3G    insgesamt
1,1G    /var/log/journal
143M    /var/log/atop
53M     /var/log/collectl
13M     /var/log/installer
6,0M    /var/log/kern.log.3.gz
5,9M    /var/log/debug.3.gz
3,9M    /var/log/atop.log.8
3,6M    /var/log/atop.log.10
3,5M    /var/log/atop.log.14

I think the journal takes quite a bit of space compared to what rsyslog
produces with its standard logrotate settings (especially if you
substract the 143M atop performance data):

merkaba:~> cat /etc/logrotate.d/rsyslog
/var/log/syslog
{
        rotate 7
        daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                invoke-rc.d rsyslog rotate > /dev/null
        endscript
}

/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
        rotate 4
        weekly
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
                invoke-rc.d rsyslog rotate > /dev/null
        endscript
}



Do you have any intention to reduce this at least a bit?

Hmm, I see this defaults to 10% (SystemMaxUse) of the filesystem. This can
get pretty large with a larger root filesystem.

Ah, it seems I can set a "MaxRetentionSec=" to "14day" or so.

Okay, that will cover my needs I think.

Still, I send this as you raise the question whether the current default
is good for systems with SSD or embedded systems. At least it can easily get
much larger than what rsyslog produces by default and may be an unexpected
additional size allocation for administrators of systems.

Thanks,
Martin


-- Package-specific info:

-- System Information:
Debian Release: 8.0
  APT prefers unstable
  APT policy: (500, 'unstable'), (200, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.18.0-tp520 (SMP w/4 CPU cores; PREEMPT)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages systemd depends on:
ii  acl             2.2.52-2
ii  adduser         3.113+nmu3
ii  initscripts     2.88dsf-58
ii  libacl1         2.2.52-2
ii  libaudit1       1:2.4-1+b1
ii  libblkid1       2.25.2-4
ii  libc6           2.19-13
ii  libcap2         1:2.24-6
ii  libcap2-bin     1:2.24-6
ii  libcryptsetup4  2:1.6.6-4
ii  libgcrypt20     1.6.2-4+b1
ii  libkmod2        18-3
ii  liblzma5        5.1.1alpha+20120614-2+b3
ii  libmount1       2.25.2-4
ii  libpam0g        1.1.8-3.1
ii  libselinux1     2.3-2
ii  libsystemd0     218-2
ii  mount           2.25.2-4
ii  sysv-rc         2.88dsf-58
ii  udev            215-8
ii  util-linux      2.25.2-4

Versions of packages systemd recommends:
ii  dbus            1.8.12-1
ii  libpam-systemd  218-2

Versions of packages systemd suggests:
ii  systemd-ui  3-2

-- no debconf information