replacing rsyslogd in minimal with journald [was Re: systemd requires HTTP server and serves QR codes]

[Lennart Poettering]

On Tue, 09.10.12 13:40, Chris Adams (cmadams at hiwaay.net) wrote:

> Once upon a time, Lennart Poettering <mzerqung at 0pointer.de> said:
> > Only users in the "adm" group can see system logs and logs of
> > other users.
> 
> Is this configurable (if so, how)?  For example, all the "wheel is
> special" behavior I am aware of is configurable (e.g. PAM config,
> visudo).

This is currently not configurable.

> Also: what is the equivalent for logrotate in the systemd journal
> case?

Rotation happens in-line, i.e. each time before we are about to write an
entry we check if rotation is necessary and execute it. This should make
things a lot more robust, as this fixes a common issue with syslog where
a lot of data generated in bursts could flood the fs until a much later
time-based rotation took place. This time window goes away with the journal.

> How can you configure how much log data is kept and for how long?

Rotation is strictly bound to disk size and space. There's an upper
limit on how much journald will consume, and a lower limit on how much
journald will always leave free.

See SystemMaxUse= resp. SystemKeepFree= in journald.conf(5).

Lennart

-- 
Lennart Poettering - Red Hat, Inc.