为什么 journald 使用这么多空间来存储这么少的数据,以及如何减少或压缩日志?

为什么 journald 使用这么多空间来存储这么少的数据,以及如何减少或压缩日志?

我使用 journald,内存限制为 55MB,仅用于记录日志。但不知何故,这相当于不到一天的日志量。

配置:

$ grep -v '^#' /etc/systemd/journald.conf

[Journal]
Storage=volatile
RuntimeMaxUse=50M
RuntimeKeepFree=75M
RuntimeMaxFileSize=5M
RuntimeMaxFiles=100
ForwardToSyslog=yes
MaxLevelSyslog=debug

磁盘使用情况:

$ journalctl --disk-usage
Archived and active journals take up 55.0M in the file system.

journalctl 输出的未压缩大小为 3.1M:

journalctl >logs; du -h logs
3.1M    logs

压缩后大小为153K:

$ journalctl |gzip >logs.gz; du -h logs.gz
153K    logs.gz

更新: 即使使用 journalctl -a -o verbose 输出数据也只使用了 journald 消耗的一半:

$ journalctl -a -o verbose >foo; df -h foo
27M     foo

并且它压缩到 journald 消耗的五十分之一:

$ journalctl -a -o verbose |gzip >foo.z; du -h foo.z
1.7M    foo.z

更新结束

根据 journalctl --verify 检查,日志是健康的:

$ journalctl --verify
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000e845-0005c8103bd20432.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000db61-0005c80f5363b862.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000ce71-0005c80e6a86dafe.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000c18f-0005c80d81a2f3f8.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000b4b6-0005c80c9979b637.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000a7ca-0005c80bb0d1ff50.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000009ade-0005c80ac8242caf.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000008e05-0005c809dfaf56fb.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000008118-0005c808f6e12c0d.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000742e-0005c80806b00481.journal


$ ls -alh /run/log/journal/69357476ee55415c8407fc9f84dc235d/
total 55M
drwxr-s---+ 2 root systemd-journal  260 Jul 27 11:53 .
drwxr-sr-x  3 root systemd-journal   60 Jul 26 15:42 ..
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 02:08 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000742e-0005c80806b00481.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 03:13 system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000008118-0005c808f6e12c0d.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 04:18 system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000008e05-0005c809dfaf56fb.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 05:23 system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000009ade-0005c80ac8242caf.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 06:28 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000a7ca-0005c80bb0d1ff50.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 07:33 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000b4b6-0005c80c9979b637.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 08:38 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000c18f-0005c80d81a2f3f8.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 09:43 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000ce71-0005c80e6a86dafe.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 10:48 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000db61-0005c80f5363b862.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 11:53 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000e845-0005c8103bd20432.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 12:18 system.journal

那么为什么以及如何 journald 使用 359 倍的空间来存储轻易压缩到 153K 的内容?

什么东西占用了 99.8% 的空间?有没有办法以牺牲这 99.8% 的空间为代价来存储更多的数据?

相关内容