Join Log in
Score:1
TobiV avatar Ubuntu

Why does journald use so much space to store so little data, and how can I reduce or compress the journal logs?

cn flag
TobiV

I use journald with memory only logging limited to 55MB. But somehow this equates to less than a days worth of logging.

Config:

$ grep -v '^#' /etc/systemd/journald.conf

[Journal]
Storage=volatile
RuntimeMaxUse=50M
RuntimeKeepFree=75M
RuntimeMaxFileSize=5M
RuntimeMaxFiles=100
ForwardToSyslog=yes
MaxLevelSyslog=debug

Disk usage:

$ journalctl --disk-usage
Archived and active journals take up 55.0M in the file system.

The uncompressed size of the output of journalctl is 3.1M:

journalctl >logs; du -h logs
3.1M    logs

The compressed size is 153K:

$ journalctl |gzip >logs.gz; du -h logs.gz
153K    logs.gz

UPDATE: Even when using journalctl -a -o verbose The output data uses half of what journald consumes:

$ journalctl -a -o verbose >foo; df -h foo
27M     foo

And it compresses to a 50th of what journald consumes:

$ journalctl -a -o verbose |gzip >foo.z; du -h foo.z
1.7M    foo.z

END UPDATE

The journals are healthy according to journalctl --verify:

$ journalctl --verify
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000e845-0005c8103bd20432.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000db61-0005c80f5363b862.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000ce71-0005c80e6a86dafe.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000c18f-0005c80d81a2f3f8.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000b4b6-0005c80c9979b637.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000a7ca-0005c80bb0d1ff50.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000009ade-0005c80ac8242caf.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000008e05-0005c809dfaf56fb.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000008118-0005c808f6e12c0d.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000742e-0005c80806b00481.journal


$ ls -alh /run/log/journal/69357476ee55415c8407fc9f84dc235d/
total 55M
drwxr-s---+ 2 root systemd-journal  260 Jul 27 11:53 .
drwxr-sr-x  3 root systemd-journal   60 Jul 26 15:42 ..
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 02:08 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000742e-0005c80806b00481.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 03:13 system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000008118-0005c808f6e12c0d.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 04:18 system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000008e05-0005c809dfaf56fb.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 05:23 system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000009ade-0005c80ac8242caf.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 06:28 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000a7ca-0005c80bb0d1ff50.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 07:33 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000b4b6-0005c80c9979b637.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 08:38 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000c18f-0005c80d81a2f3f8.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 09:43 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000ce71-0005c80e6a86dafe.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 10:48 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000db61-0005c80f5363b862.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 11:53 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000e845-0005c8103bd20432.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 12:18 system.journal

So why and how does journald use 359 times more space to store what compresses easily to 153K?

What's taking up 99.8% of the space, and is there a way to store more data at the cost of whatever that 99.8% is?

314
0 + 5
muru avatar
us flag
muru
`journalctl >logs` ... did you check how far back the default output of `journalctl` goes?
0
Reply
TobiV avatar
cn flag
TobiV
Yes, as mentioned in the question, but I didn't post the output so here it is: ``journalctl -n0``: ``-- Logs begin at Tue 2021-07-27 01:01:21 AEST, end at Tue 2021-07-27 12:40:31 AEST. --``
0
Reply
muru avatar
us flag
muru
What about `journalctl -a -o verbose -n all`?
0
Reply
TobiV avatar
cn flag
TobiV
`-n all` doesn't affect it
0
Reply
meuh avatar
cn flag
meuh
Poettering describes the journal file internals [here](https://systemd.io/JOURNAL_FILE_FORMAT/). `journalctl --header` on my logs usually shows *Data Hash Table Fill: 75%* which is the reason they get rotated. Presumably a lot of space is preallocated as even empty journals take up the same space (and are not sparse).
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.