Bug#773538: systemd: journal is quite big compared to rsyslog output

[Yuri D'Elia]

Package: systemd
Version: 228-2
Followup-For: Bug #773538

I'd also like to add that journalctl logging format is not just a bit, but a
*lot* bigger than a regular syslog daemon.

On two similar systems that I have, one configured with rsyslog and one with
journalctl, I have ~200MB for the entire /var/log tree with rsyslog+logrotate
for one year of retention.
  
Meanwhile, I'm at ~420MB for a 2 month retention *just* for /var/log/journal on
the other. I used to have MaxRetentionSec=6month, until logs grew beyond 2GB
and I started to notice. I never thought it would grow so fast (in fact, I
never had a reason to reduce retention below 1Y before).

I don't think SystemMaxUse/KeepFree make sense for a logging daemon. I'm
interested in retention time first. Increasing retention if additional space is
available would be nice, but not at this cost unfortunately.

I like the journalctl interface in general, so working on a more efficient
storage format would be important.

Otherwise, it's actually smarter to remove the retention limit, and just dump
the log to a regular text file before vacuuming. That feels backward.