I have poor knowledge of how journald works. I have several questions alongside with the main issue.
I use following
journald configuration on Ubuntu 16.04 servers
[Journal] Storage=persistent SystemMaxUse=100G SystemKeepFree=10G SystemMaxFileSize=1G
Others left default
Logs are got from docker application. I would like to use max 100G if enough space available on storage and keep 10G free if not. Didn't I miss something?
Today I found out that journald is stopped on a number of machines.
$ systemctl status systemd-journald ● systemd-journald.service - Journal Service Loaded: loaded (/lib/systemd/system/systemd-journald.service; static; vendor preset: enabled) Active: inactive (dead) (Result: core-dump) since ср 2018-04-11 23:10:32 EEST; 1 weeks 1 days ago Docs: man:systemd-journald.service(8) man:journald.conf(5) Process: 31584 ExecStart=/lib/systemd/systemd-journald (code=dumped, signal=ABRT) Main PID: 31584 (code=dumped, signal=ABRT)
I see no any core dump in
All of them has storage < 100G. So, I assumed that logs fill out the space, leave 10G free and after that the oldest one will be deleted (rotated)... and logs accumulating continue. Am I right?
But first machine has 4.3G free space, second one 8.3G. There are also machines that have > 10G free where journald stopped.
$ systemd --version systemd 229 +PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ -LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN
I thought may be it's possible to update
systemd. But it definitely is not simple like
On one machine before I was able to start
systemd-journald I had to purge logs.
I'm very glad that 18.04 is coming, but anyway any ideas are appreciated.