I now set up a new PMG with Debian 11. I recognized, that/var/log/journal is increasing from day to day. It looks like no rotation or limit at all. Is this typical? Is there any solution? About 11 days running I have on a low volume system now 1.1G
Increasing /var/log/journal
- Thread starter heutger
- Start date
Did you check what is actually spamming your journal? Usually it's best to fix the cause, instead of limiting log retention.
Not sure about PMG, but here with PVE the journal wasn`t limited. You can limit it by editing "#SystemMaxUse=" to something like "SystemMaxUse=100M" in "/etc/systemd/journald.conf" and then do a
Not sure about PMG, but here with PVE the journal wasn`t limited. You can limit it by editing "#SystemMaxUse=" to something like "SystemMaxUse=100M" in "/etc/systemd/journald.conf" and then do a
systemctl restart systemd-journald.
It seems like everything, which is (also?) logged elsewhere is logged here: Mailflow (smtpd), OpenVPN (which I set up), UFW (which I set up), ...
Yes - this has been that way since the past 8-9 years - the journal logs everything, and is also the first user of /dev/log (where the syslog calls write to) - it then relays the messages to syslog if configured that way.
It's not recommended (don't know if it's sensibly possible either) to disable the journal - and you need rsyslog for the tracking center (which reads its data from /var/log/syslog ...)
I‘m quite unsure, but won‘t believe that was the same for my recent PMG installation on Debian 9 (first PMG open source release)? I can’t remember such huge logfiles there. If I would set as above a limit on journald, will the tracking center still work as the syslog itself after relaying is handled separate, e.g. by logrotate or will it break something?
Looks like this change seems to be newer than 8-9 years: https://www.heise.de/newsticker/mel...as-Logging-in-Debian-uebernehmen-4655857.html
Looks like this change seems to be newer than 8-9 years: https://www.heise.de/newsticker/mel...as-Logging-in-Debian-uebernehmen-4655857.html
that change was about enabling the persistent journal per default - did you have that in your old installation?
(it's one of the first things I do on all debian installations so that was my assumptions were wrong)
That should work fine - as long as /var/log/syslog contains logs from the mail-facility the tracking center should work
Probably simply removing /var/log/journal should be enough - see `man journald.conf` (the Storage parameter)
Before changing here anything, what are the Proxmox recommendations on this? Recently I rejoined an old discussion on how long log files should be stored because on privacy, storage and performance. An unlimited journal log then completely runs the opposite way than recommending smaller rotation intervalls.
And no, the recent installation seems not to have a journal log.
And no, the recent installation seems not to have a journal log.
Addition: Thanks for the hint, checking the config values possible, I see, that it isn’t unlimited. The value per default is 10% of diskspace and keep 15% of diskspace free.
no official recommendation - I personally would store the logs for as long as its permitted - since it can always help in finding an issue later on.
additionally I do keep both the journal and the text-logs around, since both have their merits when looking for things
If your environment is sensitive to data-exfiltration - or has other requirements of keeping strict privacy - I would act accordingly and maybe even don't store logs at all (but that of course also means no tracking center etc....)
Not quite sure what you mean here - /var/log/journal is not present on a fresh installation ?
I upgraded from a very old hard customized PMG based on Debian 9 as described in my Advancing Thread to a low customized new PMG based on Debian 11. This old version of PMG and Debian I had no issues with huge journal logs, but with the new PMG and Debian 11 I got now. I do a local backup and then copy to offsite and as well this backup increased very much as also backing up /var/log. I removed now from direct backup (there is still a cloud server backup as well, which backups everything) to keep diskspace under control.