Bug#766074: systemd: users should not have to put a value greater than desired in MaxRetentionSec to avoid loss of information

[Santiago Vila]

Package: systemd
Version: 215-5+b1

I modified /etc/systemd/journald.conf by adding these two lines:

MaxRetentionSec=7day
MaxFileSec=1day

Before the change, journalctl says:

-- Logs begin at vie 2014-10-10 14:33:54 CEST, [...]

After the change, journalctl says:

-- Logs begin at mié 2014-10-15 03:37:58 CEST, [...]

But today is 2014-10-20 19:20 CEST, so apparently there has been loss
of information here, as I can't anymore get log entries between
2014-10-13 19:20 (seven days ago, as specified in the configuration
file) and the time journalctl says the log begins.

Manual says:

MaxRetentionSec=

  The maximum time to store journal entries. This controls whether
  journal files containing entries older then the specified time
  span are deleted.

Ok, but what happens if the specified time is in the middle of a journal file?

It seems that current behaviour is that as far as a journal file has a
*single* entry older than the specified time, the entire journal file
is discarded, including entries which are older than the time limit
but also entries which are a little bit newer than the time limit.

We could discuss whether or not this matches the documentation, but in
my opinion this behaviour is not what one would expect.

I would expect journal files to be discarded only when all of its
entries have expired, or, at the very minimum, manual should warn the
user that if he/she wants to keep a whole week of logs, then the value
of MaxRetentionSec should be greater than a week.

Thanks.