I use journald with memory only logging limited to 55MB. But somehow this equates to less than a days worth of logging.

Config:

$ grep -v '^#' /etc/systemd/journald.conf [Journal] Storage=volatile RuntimeMaxUse=50M RuntimeKeepFree=75M RuntimeMaxFileSize=5M RuntimeMaxFiles=100 ForwardToSyslog=yes MaxLevelSyslog=debug 

Disk usage:

$ journalctl --disk-usage Archived and active journals take up 55.0M in the file system. 

The uncompressed size of the output of journalctl is 3.1M:

journalctl >logs; du -h logs 3.1M logs 

The compressed size is 153K:

$ journalctl |gzip >logs.gz; du -h logs.gz 153K logs.gz 

UPDATE: Even when using journalctl -a -o verbose The output data uses half of what journald consumes:

$ journalctl -a -o verbose >foo; df -h foo 27M foo 

And it compresses to a 50th of what journald consumes:

$ journalctl -a -o verbose |gzip >foo.z; du -h foo.z 1.7M foo.z 

END UPDATE

The journals are healthy according to journalctl --verify:

$ journalctl --verify PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system.journal PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/ PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/ PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/ PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/ PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/ PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/ PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/ PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/ PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/ PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/ $ ls -alh /run/log/journal/69357476ee55415c8407fc9f84dc235d/ total 55M drwxr-s---+ 2 root systemd-journal 260 Jul 27 11:53 . drwxr-sr-x 3 root systemd-journal 60 Jul 26 15:42 .. -rw-r-----+ 1 root systemd-journal 5.0M Jul 27 02:08 -rw-r-----+ 1 root systemd-journal 5.0M Jul 27 03:13 -rw-r-----+ 1 root systemd-journal 5.0M Jul 27 04:18 -rw-r-----+ 1 root systemd-journal 5.0M Jul 27 05:23 -rw-r-----+ 1 root systemd-journal 5.0M Jul 27 06:28 -rw-r-----+ 1 root systemd-journal 5.0M Jul 27 07:33 -rw-r-----+ 1 root systemd-journal 5.0M Jul 27 08:38 -rw-r-----+ 1 root systemd-journal 5.0M Jul 27 09:43 -rw-r-----+ 1 root systemd-journal 5.0M Jul 27 10:48 -rw-r-----+ 1 root systemd-journal 5.0M Jul 27 11:53 -rw-r-----+ 1 root systemd-journal 5.0M Jul 27 12:18 system.journal 

So why and how does journald use 359 times more space to store what compresses easily to 153K?

What's taking up 99.8% of the space, and is there a way to store more data at the cost of whatever that 99.8% is?

5

Reset to default

Know someone who can answer? Share a link to this question via email, Twitter, or Facebook.

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password

Post as a guest

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy