Configuring the systemd journal for persistence

By default, the journal doesn't store log files on disk, only in memory or the /run/log/journal directory. This is sufficient for the recent log history (with the journal) but not for long-term log retention should you decide to go with journal only and not with any other syslog solution.

How to do it…

Configuring journald to keep more logs than memory allows is fairly simple, as follows:

  1. Open /etc/systemd/journald.conf with your favorite text editor with root permissions by executing the following command:
    ~]# vim /etc/systemd/journald.conf
  2. Ensure that the line containing Storage is either remarked or set to auto or persistent and save it, as follows:
    Storage=auto
  3. If you select auto, the journal directory needs to be manually created. The following command would be useful for this:
    ~]# mkdir -p /var/log/journal
  4. Now, restart the journal service by executing the following command:
    ~]# systemctl restart systemd-journald

There's more…

There are many other options that can be set for the journal daemon.

By default, all the data stored by journald is compressed, but you could disable this using Compress=no.

It is recommended to limit the size of the journal files by either specifying a maximum retention age (MaxRetentionSec), a global maximum size usage (SystemMaxUse), or a maximum size usage per file (SystemMaxFileSize).

See also

For more information about using the journal with RHEL 7, go to https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/s1-Using_the_Journal.html.

Take a look at the man page for journald (5) for more information on what can be configured.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset