Preguntas Frecuentes - FAQ

To increase the log retention size for systemd-journald, modify the /etc/systemd/journald.conf file, focusing on the [Journal] section. The key options for controlling disk space usage and log retention are:

• Storage - Controls where systemd-journald saves logs, with options like 'volatile' (RAM only, lost on reboot), 'persistent' (disk /var/log/journal/), 'auto' (disk if /var/log/journal exists, else RAM), and 'none' (no storage, logs dropped). 'auto' is the default, using /var/log/journal/ if present, otherwise volatile storage, making it easy to enable persistence by just creating that directory.
• SystemMaxUse - The maximum total disk space that persistent journal logs (stored in /var/log/journal/) can occupy. Set this to a value like 10G for 10 Gigabytes, or 500M for 500 Megabytes.
• SystemKeepFree - The minimum amount of free disk space that journald should leave available on the filesystem where persistent logs are stored. This prevents the journal from consuming all available space. For example, SystemKeepFree=5G would ensure at least 5 Gigabytes remain free.
• SystemMaxFileSize - The maximum size of individual persistent journal files before they are rotated. For example, SystemMaxFileSize=1G would cap individual files at 1 Gigabyte.
• SystemMaxFiles - The maximum number of individual journal files (both active and archived) to keep, acting as a file count limit that works alongside size limits like SystemMaxUse and SystemMaxFileSize to control log retention; if you have many small files or very active logging, SystemMaxFiles can become the limiting factor, causing older logs to be deleted even if total disk space isn't full yet.
• MaxRetentionSec - The maximum time to store journal entries. You can specify a duration like 1month, 1year, 30days, or 7d. Setting it to 0 disables time-based retention.

Enable Persistent Logs

Create the persistent log directory if it doesn't exist and apply the correct permissions and ownership:

mkdir -p /var/log/journal
systemd-tmpfiles --create --prefix /var/log/journal

Flush the current volatile logs to the new persistent storage (optional, if you don't want to reboot immediately):

journalctl --flush

To increase the journal size to 32GB, ensure 5GB of free space, and keep logs for a maximum of one month edit the systemd-journal configuration file /etc/systemd/journald.conf adding the options below:

[Journal]
Storage=persistent
SystemMaxUse=32G
SystemKeepFree=5G
SystemMaxFileSize=512M
SystemMaxFiles=4096
MaxRetentionSec=1month

Restart the systemd-journal to apply the new configuration:

systemctl restart systemd-journald

Note: Similar Runtime* options exist for volatile logs stored in /run/log/journal/, which are lost upon reboot. Ensure Storage=persistent is set in /etc/systemd/journald.conf for changes to affect persistent logs.