Base de Conhecimento

Overview

The systemd-journald service manages system logging on Linux distributions utilizing systemd. Log retention, storage location, and disk space allocation are controlled through parameters defined in the /etc/systemd/journald.conf configuration file. Adjusting these settings enables administrators to optimize storage utilization, enforce retention policies, and ensure critical logs persist across system reboots.

Configuration Parameters

The following parameters within the [Journal] section govern log storage behavior and retention limits:

• Storage: Defines the logging backend. Valid values include volatile (RAM-only, cleared on reboot), persistent (disk-based at /var/log/journal/), auto (uses disk if /var/log/journal/ exists, otherwise RAM), and none (logs are discarded). The default setting is auto.
• SystemMaxUse: Specifies the maximum total disk space allocated for persistent journal logs. Accepts values such as 10G or 500M.
• SystemKeepFree: Defines the minimum amount of free disk space to reserve on the filesystem hosting persistent logs, preventing log growth from consuming all available storage. Example: 5G.
• SystemMaxFileSize: Sets the maximum size for individual journal files before rotation occurs. Example: 1G.
• SystemMaxFiles: Limits the total number of active and archived journal files retained. This parameter operates alongside size limits to manage retention, particularly in high-volume logging environments where file count may become the limiting factor.
• MaxRetentionSec: Defines the maximum duration for storing journal entries. Accepts time formats such as 1month, 30days, or 7d. Setting this to 0 disables time-based retention.

Procedure

Follow the steps below to configure persistent logging and adjust retention limits:

1. 1. Enable Persistent Logging: Create the required directory structure and apply appropriate permissions. If volatile logs are currently active, flush them to disk to preserve recent entries before service restart.

mkdir -p /var/log/journal
systemd-tmpfiles --create --prefix /var/log/journal

journalctl --flush

1. 1. Configure Retention Settings: Edit the systemd-journald configuration file and update the [Journal] section with your desired parameters. The example below configures an 8GB maximum usage, reserves 5GB of free space, limits individual files to 256MB, caps retention at 100 files, enforces a one-month retention period, and enables compression.

[Journal]
Storage=persistent
SystemMaxUse=8G
SystemKeepFree=5G
SystemMaxFileSize=256M
SystemMaxFiles=100
MaxRetentionSec=1month
Compress=yes

1. 1. Apply Configuration Changes: Restart the journald service to load the updated configuration.

systemctl restart systemd-journald

Troubleshooting & Notes

• Volatile vs. Persistent Configuration: Parameters prefixed with Runtime* apply exclusively to volatile logs stored in /run/log/journal/, which are cleared upon system reboot. To ensure retention settings affect persistent logs, verify that Storage=persistent is explicitly defined in /etc/systemd/journald.conf.
• Configuration Verification: Confirm active parameters by querying the service status. If logs are not rotating as expected, validate that the target filesystem has sufficient free space and check for conflicting drop-in configuration files.
• Disk Space Thresholds: When disk usage reaches the SystemKeepFree threshold before hitting SystemMaxUse, journald will automatically prune older logs to maintain the specified free space reserve.