I would like to have persistent logs via journald. I created /var/log/journal and reloaded the service. Now logs are saved on the disk. But the log size limit is low.
I added /etc/systemd/journald.conf. (Storage=persistent/auto doesn't matter, I tried both).
[Journal]
Storage=persistent
#Compress=yes
#Seal=yes
#SplitMode=uid
#SyncIntervalSec=5m
#RateLimitInterval=30s
#RateLimitBurst=1000
#SystemMaxUse=
SystemKeepFree=10G
SystemMaxFileSize=1G
#SystemMaxFiles=100
#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=
#RuntimeMaxFiles=100
#MaxRetentionSec=
#MaxFileSec=1month
#ForwardToSyslog=yes
#ForwardToKMsg=no
#ForwardToConsole=no
#ForwardToWall=yes
#TTYPath=/dev/console
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#MaxLevelWall=emerg
As you can see I only changed each journal file size to 1Gb and told that I want 10Gb free on the disk.
But journald tells me that he only has 4Gb log storage capacity.
$ sudo systemctl status systemd-journald
...
jan 20 15:44:26 host systemd-journald[1218]: System journal (/var/log/journal/) is 4.5G, max 4.0G, 0B free.
jan 20 15:44:26 host systemd-journald[1218]: Journal started
What did I miss?
$ systemctl --version
systemd 229
+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ -LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN
This manual also contains such stanza.
The first pair defaults to 10% and the second to 15% of the size of the respective file system, but each value is capped to 4G.
Does it mean that the maximum space can be occupied by the log is 4Gb and hard coded?
Journal messages are only retained if they satisfy all limits – time and space. Raising a single limit does not automatically override other ones.
As mentioned in docs, SystemMaxUse= defaults to 10% of your file system, and the default value is capped to 4 GB (not Gb!). You must raise it manually.
Since you did not actually set a custom value for SystemMaxUse=, it continues limiting your logs to a total maximum of 4 GB.