The Computer Oracle

How to logrotate with systemd?

--------------------------------------------------
Become or hire the top 3% of the developers on Toptal https://topt.al/25cXVn
--------------------------------------------------

Music by Eric Matyas
https://www.soundimage.org
Track title: City Beneath the Waves Looping

--

Chapters
00:00 Question
00:53 Accepted answer (Score 21)
02:46 Thank you

--

Full question
https://superuser.com/questions/1202771/...

--

Content licensed under CC BY-SA
https://meta.stackexchange.com/help/lice...

--

Tags
#systemd #logrotate

#avk47



ACCEPTED ANSWER

Score 24


Increasing Storage

If you are storing to disk you can increase the amount of space used by changing SystemMaxUse and/or SystemKeepFree. Having more space would allow more entries to be stored.

By default the maximum use limit (SystemMaxUse) is 10% of the filesystem, and the minimum free space (SystemKeepFree) value is 15% - though they are both capped at 4G.

Journal Rotation

The journals should be rotated automatically when they reach the SystemMaxFileSize value, and the number of journals is controlled by SystemMaxFiles. If you prefer time based rotation you can set a MaxFileSec to set the maximum time entries are stored in a single journal.

Note on Storage Location/Type

With journald you can choose to store the journal entries either in memory (Storage=volatile) or on disk (Storage=persistent). The above assumes you are storing journals on disk - if this is not the case "System" will need to be replaced by "Runtime" in the above variables.

Further details are available in man journald.conf.

Alternative - Passing on the journal entries

If you are already familiar with the traditional SYSLOG daemon you can pass the journal events on by setting the ForwardToSyslog option (which forwards the messages immediately) or have the syslog daemon behave like a journal client and fetch the logs itself.




ANSWER 2

Score 1


You have another solution based on time. If you want to store systemd logs upon one year for example with a file by week, you edit the /etc/systemd/journald.conf configuration file :

[Journal]
Storage=persistant
Compress=yes
MaxRetentionSec=1year
MaxFileSec=1week

Don't forget to comment the other directives.

You have to restart the systemd-journald daemon with the journalctl command :

systemctl restart systemd-journald

Source : Systemd : la rotation des logs (Sorry, in french)