☰

如何使用journald强制日志过期？

tag-icon • tag-icon systemd-journald
如何使用journald强制日志过期？

假设我只想保留最近 10 天的日志。

我必须跑吗

journalctl --vacuum-time=10d

每天都有计时器吗？我还需要使用吗--rotate？ “旋转日志文件”是什么意思？

我可以设置一些东西/etc/systemd/journald.conf吗？我正在阅读man 5 journald.conf，但似乎SystemMaxUse只接受字节，而不接受时间。

我不关心文件的大小或数量。正好记录日志的时间。

答案1

你应该能够使用--vacuum-time.如下所示的操作会将当前活动日志文件轮换到存档中，然后修剪所有日志以仅在该日志中保留 10 天。

journalctl --rotate --vacuum-time=10days

直接来自手册页：

--vacuum-size=, --vacuum-time= and --vacuum-files= may be combined
       in a single invocation to enforce any combination of a size, a time
       and a number of files limit on the archived journal files.
       Specifying any of these three parameters as zero is equivalent to
       not enforcing the specific limit, and is thus redundant.

       These three switches may also be combined with --rotate into one
       command. If so, all active files are rotated first, and the
       requested vacuuming operation is executed right after. The rotation
       has the effect that all currently active files are archived (and
       potentially new, empty journal files opened as replacement), and
       hence the vacuuming operation has the greatest effect as it can
       take all log data written so far into account.

相关内容