Hide Forgot
Description of problem: this is not the first time and i have seen these logs reach into GIGABYTES in size. i delete them and then on the next reboot they can be 7mb already. i suspect this is becuase they are binary logs and not text files. this is a sample from this morning. note the directory is already 33mb after the reboot. and 2 users logged on. marafa@notebook:/var/log/journal$ du -sh * 33M fed72e1673be4583a85b470cfbec51ef marafa.org:/var/log/journal$ du -sh */* 26M fed72e1673be4583a85b470cfbec51ef/system.journal 3.6M fed72e1673be4583a85b470cfbec51ef/user-1000.journal 3.6M fed72e1673be4583a85b470cfbec51ef/user-1003.journal Version-Release number of selected component (if applicable): How reproducible: every SINGLE time Steps to Reproduce: 1. rm -rf /var/log/journal/* 2. reboot 3. du -sh /var/log/journal/* the large size of the log file of gb i suspect is due to a lot of journal activity and/or a large time fram Actual results: Expected results: Additional info:
The size of individual files and also the total disk usage scale proportionally to file system size and the amount of free space, up to 4GB. So it's entirely expected for the journal to grow to gigabytes in size, space permitting. Journal files are created with a few fixed-size tables, with their size based on the maximum file size. So again, 7 mb journal file when it is created is not unexpected. This space is reserved for future use, and should be filled as entries are stored in this file. You can view some information about the file with 'journalctl --header'. Can you provide the output from 'journalctl --header' and 'journalctl|wc' ?
marafa@notebook:~/tmp$ journalctl --header File Path: /var/log/journal/fed72e1673be4583a85b470cfbec51ef/system.journal File ID: bc85f8594e47481796c832b6c1cb31d7 Machine ID: fed72e1673be4583a85b470cfbec51ef Boot ID: fc20d92bba0f4cf8b6a35188265a6bce Sequential Number ID: fc20d92bba0f4cf8b6a35188265a6bce State: ONLINE Compatible Flags: Incompatible Flags: COMPRESSED Header size: 240 Arena size: 6147856 Data Hash Table Size: 233016 Field Hash Table Size: 333 Rotate Suggested: no Head Sequential Number: 1 Tail Sequential Number: 73123 Head Realtime Timestamp: Thu 2013-11-28 15:07:57 EST Tail Realtime Timestamp: Fri 2013-11-29 08:23:18 EST Objects: 10493 Entry Objects: 3204 Data Objects: 5581 Data Hash Table Fill: 2.4% Field Objects: 45 Field Hash Table Fill: 13.5% Tag Objects: 0 Entry Array Objects: 1661 Disk usage: 5.8M File Path: /var/log/journal/fed72e1673be4583a85b470cfbec51ef/user-1000.journal File ID: 8bdeed111c26489db9aded24f0c8aa72 Machine ID: fed72e1673be4583a85b470cfbec51ef Boot ID: fc20d92bba0f4cf8b6a35188265a6bce Sequential Number ID: fc20d92bba0f4cf8b6a35188265a6bce State: OFFLINE Compatible Flags: Incompatible Flags: COMPRESSED Header size: 240 Arena size: 3792656 Data Hash Table Size: 233016 Field Hash Table Size: 333 Rotate Suggested: no Head Sequential Number: 2125 Tail Sequential Number: 73045 Head Realtime Timestamp: Wed 2013-11-20 13:12:47 EST Tail Realtime Timestamp: Fri 2013-11-29 08:11:16 EST Objects: 397 Entry Objects: 44 Data Objects: 187 Data Hash Table Fill: 0.1% Field Objects: 24 Field Hash Table Fill: 7.2% Tag Objects: 0 Entry Array Objects: 140 Disk usage: 3.6M File Path: /var/log/journal/fed72e1673be4583a85b470cfbec51ef/user-1003.journal File ID: 3ea9213787f1497cb7fce9e072b75917 Machine ID: fed72e1673be4583a85b470cfbec51ef Boot ID: fc20d92bba0f4cf8b6a35188265a6bce Sequential Number ID: fc20d92bba0f4cf8b6a35188265a6bce State: OFFLINE Compatible Flags: Incompatible Flags: COMPRESSED Header size: 240 Arena size: 3763984 Data Hash Table Size: 233016 Field Hash Table Size: 333 Rotate Suggested: no Head Sequential Number: 18573 Tail Sequential Number: 72965 Head Realtime Timestamp: Sat 2013-11-23 10:00:14 EST Tail Realtime Timestamp: Fri 2013-11-29 08:10:06 EST Objects: 222 Entry Objects: 21 Data Objects: 106 Data Hash Table Fill: 0.0% Field Objects: 21 Field Hash Table Fill: 6.3% Tag Objects: 0 Entry Array Objects: 72 Disk usage: 3.5M File Path: /var/log/journal/fed72e1673be4583a85b470cfbec51ef/system~ File ID: a84eeb8ebdc44b65a6fb086a064fd846 Machine ID: fed72e1673be4583a85b470cfbec51ef Boot ID: 093aa14175154192b8a71d5c047a3a05 Sequential Number ID: 093aa14175154192b8a71d5c047a3a05 State: OFFLINE Compatible Flags: Incompatible Flags: COMPRESSED Header size: 240 Arena size: 51859216 Data Hash Table Size: 233016 Field Hash Table Size: 333 Rotate Suggested: no Head Sequential Number: 1 Tail Sequential Number: 74907 Head Realtime Timestamp: Wed 2013-11-20 13:02:16 EST Tail Realtime Timestamp: Thu 2013-11-28 14:32:18 EST Objects: 167825 Entry Objects: 74851 Data Objects: 84195 Data Hash Table Fill: 36.1% Field Objects: 48 Field Hash Table Fill: 14.4% Tag Objects: 0 Entry Array Objects: 8729 Disk usage: 49.5M marafa@notebook:~/tmp$ journalctl|wc 78125 956482 9626199
61MB / 78125 records = 780 bytes / record. This is not particularly efficient, but since the journal includes two timestamps and additional information for each record, it's not outrageous either. Also please note that if you allow those files to grow, storage should become more efficient as time goes on, because duplicate fields are not stored multiple times, so at some point the average number of bytes / record should go down.
We log substantially more data, this hence necessarily is larger thatn the old text files. I don't see anything to fix here really...