Journalctl and Journaling on by Default?

Horizon_Brave · 2017-04-10 19:26:37

Hey everyone...so many pardons if this has been discussed previously... But is there a reason why we don't for our own iso images make systemd's journald set the "storage" parameter to persistent from the getgo? ( I would also recommend setting the "compress" line to 'yes" and uncomment it.) By default, this is commented out and set to auto.

I only ask because we seem to recommend changing it anyway if something we encounter can't be traced with a dmesg boot log, or the older /var/log/syslog files...
Would a script that's run on initial start up, to change the line "Storage" and perhaps set the compression to 'yes', be something that would be advantageous to most? I'd think so, and with people usually having more than the needed space nowadays, I can't see why this would really be an issue. Plus there's always the /etc/systemd/journal.conf file that a user can modify to restrict space and max file size of the journal logs...

Sector11 · 2017-04-10 20:01:26

Gee, I wonder where you got this idea from, I was about to post something very similar as well.

I concur!

Head_on_a_Stick · 2017-04-10 20:03:13

Horizon_Brave wrote:

is there a reason why we don't for our own iso images make systemd's journald set the "storage" parameter to persistent from the getgo?

I suggested this (purely for selfish reasons) but it was decided to stick with the upstream defaults.

We're based on Debian stable — we don't need no stinkin' logs...

Sector11 · 2017-04-10 20:45:53

But ... but ... dizzy - I'm so dizzy ....

Horizon_Brave · 2017-04-11 00:04:15

Do we also not like innovation?? I'm half joking of course, and I love sticking close to the apron strings of Ma' Deb trust me... but for something small yet convenient like this...I just don't see the harm..?

johnraff · 2017-04-11 02:34:40

Isn't it about the log directory growing and growing and filling up some peoples' hard disks?

Sector11 · 2017-04-11 03:15:29

Yea, if I recall right, not to long ago there was something about that.

ohnonot · 2017-04-11 05:51:12

It's just another of these things that takes bunsenlabs further from the mothership.
maybe i should call it "The Distro Trap" instead.

But as far as functionality is concerned:
- it is set up that way on archlinux anyway, also I don't need sudo to view the journal
- mylog directory is not growing wildly

Maybe it is about to be changed for the new debian release anyway?
After all, archlinux already has quite a few more years of systemd experience (he said smugly)

johnraff · 2017-04-11 07:03:09

ohnonot wrote:

It's just another of these things that takes bunsenlabs further from the mothership.

What do you mean? We haven't changed anything.
Having those logs disabled is the Debian default. We do in fact try to stay as close as possible to Debian, unless some good reason turns up to change, which it seldom does...

OK other setups, like Arch, have journaling on by default, and if enough of our users would prefer it that way, then for sure we'd have to consider it. It's a pretty trivial change either way.

BTW my /var/log/journal currently holds 2.6GB, so disk space might be a consideration for some people.

Last edited by johnraff (2017-04-11 07:04:52)

Head_on_a_Stick · 2017-04-11 07:10:25

ohnonot wrote:

- it is set up that way on archlinux anyway, also I don't need sudo to view the journal
- mylog directory is not growing wildly

I'm not in Debian at the moment but I think it has adopted the same upstream defaults as Arch in respect of log size limits so that would not actually be a problem.

EDIT: it seems that I am wrong about this, see my reply to johnraff below for a fix.

Arch's systemd package includes /var/log/journal but the Debian package does not — this is why Arch stores logs by default.

Maybe it is about to be changed for the new debian release anyway?

No, not on my stretch system.

Last edited by Head_on_a_Stick (2017-04-11 07:18:54)

Head_on_a_Stick · 2017-04-11 07:11:39

johnraff wrote:

my /var/log/journal currently holds 2.6GB

Restrict the maximum size in /etc/systemd/journald.conf

For stretch, you can "vacuum" away excess journal contents

Head_on_a_Stick · 2017-04-11 07:16:45

Just to add, I think that Debian does not enable the systemd logging facilities by default because it also uses the (legacy) syslog methods and these are enabled OOTB — there is little point in having two logging systems running at the same time.

The only reason that we see lots of threads in which I request that persistent journalling be enabled is because I have no idea how to use the legacy logging methods :8

EDIT: sorry for the multipost.

Last edited by Head_on_a_Stick (2017-04-11 07:17:31)

ohnonot · 2017-04-11 18:22:50

johnraff wrote:

What do you mean? We haven't changed anything.

sorry about that.
it should've been:

ohnonot wrote:

It would be just another of these things that would take bunsenlabs further from the mothership.

but maybe debian will adopt these - imho - saner policies in its next release anyway?

hhh · 2017-04-11 18:49:17

My only computer for a year was an Acer netbook with an 8G SSD. jessie ran like a champ on it, but it certainly didn't have space to spare.

BL has become known, as #! was, as a great distrolet for low resource systems, and Debian has made our task easy. I'd vote for not changing the default in this instance.

MsMattie · 2017-04-12 06:51:49

I definitely vote AGAINST changing the default if it would mean taking up more SSD space. Maybe what is being considered would not do that. But if it is a net minus on space then I personally would prefer it be something that I would have to consciously turn on.

Last edited by MsMattie (2017-04-12 07:09:25)

Horizon_Brave · 2017-04-12 16:29:10

+sigh+

SystemMaxUse= and RuntimeMaxUse= control how much disk space the journal may use up at most.
The first pair defaults to 10% and the second to 15% of the size of the respective file system, but each value is capped to 4G. If the file system is nearly full and either SystemKeepFree= or RuntimeKeepFree= are violated when systemd-journald is started, the limit will be raised to the percentage that is actually free. This means that if there was enough free space before and journal files were created, and subsequently something else causes the file system to fill up, journald will stop using more space

o9000 · 2017-04-29 08:27:19

For me, the question is what was wrong with rsyslog.

Ducks...

Sector11 · 2017-04-29 16:30:31

^ Aim for the ankles! O:)

 29 Apr 17 @ 13:24:42 ~
  $ list rsyslog
Alias for: apt list -a filename
Listing... Done
rsyslog/jessie-backports 8.23.0-2~bpo8+1 amd64
rsyslog/stable,now 8.4.2-1+deb8u2 amd64 [installed]

 
 29 Apr 17 @ 13:24:50 ~
  $ man rsyslog
No manual entry for rsyslog
 
 29 Apr 17 @ 13:25:10 ~
  $ rsyslog --help
bash: rsyslog: command not found
 
 29 Apr 17 @ 13:25:18 ~
  $ rsyslog -h
bash: rsyslog: command not found
 
 29 Apr 17 @ 13:25:24 ~
  $ rsyslog
bash: rsyslog: command not found
 
 29 Apr 17 @ 13:25:34 ~
  $

With shades of HoaS and his comment:

HoaS wrote:

The only reason that we see lots of threads in which I request that persistent journalling be enabled is because I have no idea how to use the legacy logging methods :8

Yes, and I'm 3 of them.

Steve · 2017-06-01 12:53:42

Head_on_a_Stick wrote:

Just to add, I think that Debian does not enable the systemd logging facilities by default because it also uses the (legacy) syslog methods and these are enabled OOTB — there is little point in having two logging systems running at the same time.
The only reason that we see lots of threads in which I request that persistent journalling be enabled is because I have no idea how to use the legacy logging methods :8
EDIT: sorry for the multipost.

How does one learn about legacy syslog methods?

Should this be installed

https://packages.debian.org/jessie/syslog-ng

Wanting to limit my journalctl using

sudo journalctl --vacuum-time=2days

Invalid commands?

sc@debian:~$ sudo journalctl --vacuum-time=2days
journalctl: unrecognized option '--vacuum-time=2days'

^^ how or when should that be specified or can it? Source= Freedesktop journactl

--vacuum-size=, --vacuum-time=, --vacuum-files=
Removes archived journal files until the disk space they use falls below the specified size (specified with the usual "K", "M", "G" and "T" suffixes), or all archived journal files contain no data older than the specified timespan (specified with the usual "s", "m", "h", "days", "months", "weeks" and "years" suffixes), or no more than the specified number of separate journal files remain. Note that running --vacuum-size= has only an indirect effect on the output shown by --disk-usage, as the latter includes active journal files, while the vacuuming operation only operates on archived journal files. Similarly, --vacuum-files= might not actually reduce the number of journal files to below the specified number, as it will not remove active journal files. --vacuum-size=, --vacuum-time= and --vacuum-files= may be combined in a single invocation to enforce any combination of a size, a time and a number of files limit on the archived journal files. Specifying any of these three parameters as zero is equivalent to not enforcing the specific limit, and is thus redundant.

Ok with setting

$ /etc/systemd/journald.conf

with added line

SystemMaxUse=10M

Just general curiosity from a beginner. Cheers.

o9000 · 2017-06-01 13:19:07

How does one learn about anything on debian? Maybe starting by googling/binging "rsyslog debian". First result: https://wiki.debian.org/Rsyslog

That's where I'd start.

#1 2017-04-10 19:26:37

Journalctl and Journaling on by Default?

#2 2017-04-10 20:01:26

Re: Journalctl and Journaling on by Default?

#3 2017-04-10 20:03:13

Re: Journalctl and Journaling on by Default?

#4 2017-04-10 20:45:53

Re: Journalctl and Journaling on by Default?

#5 2017-04-11 00:04:15

Re: Journalctl and Journaling on by Default?

#6 2017-04-11 02:34:40

Re: Journalctl and Journaling on by Default?

#7 2017-04-11 03:15:29

Re: Journalctl and Journaling on by Default?

#8 2017-04-11 05:51:12

Re: Journalctl and Journaling on by Default?

#9 2017-04-11 07:03:09

Re: Journalctl and Journaling on by Default?

#10 2017-04-11 07:10:25

Re: Journalctl and Journaling on by Default?

#11 2017-04-11 07:11:39

Re: Journalctl and Journaling on by Default?

#12 2017-04-11 07:16:45

Re: Journalctl and Journaling on by Default?

#13 2017-04-11 18:22:50

Re: Journalctl and Journaling on by Default?

#14 2017-04-11 18:49:17

Re: Journalctl and Journaling on by Default?

#15 2017-04-12 06:51:49

Re: Journalctl and Journaling on by Default?

#16 2017-04-12 16:29:10

Re: Journalctl and Journaling on by Default?

#17 2017-04-29 08:27:19

Re: Journalctl and Journaling on by Default?

#18 2017-04-29 16:30:31

Re: Journalctl and Journaling on by Default?

#19 2017-06-01 12:53:42

Re: Journalctl and Journaling on by Default?

#20 2017-06-01 13:19:07

Re: Journalctl and Journaling on by Default?

Board footer