我使用 journald,内存限制为 55MB,仅用于记录日志。但不知何故,这相当于不到一天的日志量。
配置:
$ grep -v '^#' /etc/systemd/journald.conf
[Journal]
Storage=volatile
RuntimeMaxUse=50M
RuntimeKeepFree=75M
RuntimeMaxFileSize=5M
RuntimeMaxFiles=100
ForwardToSyslog=yes
MaxLevelSyslog=debug
磁盘使用情况:
$ journalctl --disk-usage
Archived and active journals take up 55.0M in the file system.
journalctl 输出的未压缩大小为 3.1M:
journalctl >logs; du -h logs
3.1M logs
压缩后大小为153K:
$ journalctl |gzip >logs.gz; du -h logs.gz
153K logs.gz
更新: 即使使用 journalctl -a -o verbose 输出数据也只使用了 journald 消耗的一半:
$ journalctl -a -o verbose >foo; df -h foo
27M foo
并且它压缩到 journald 消耗的五十分之一:
$ journalctl -a -o verbose |gzip >foo.z; du -h foo.z
1.7M foo.z
更新结束
根据 journalctl --verify 检查,日志是健康的:
$ journalctl --verify
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000e845-0005c8103bd20432.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000db61-0005c80f5363b862.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000ce71-0005c80e6a86dafe.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000c18f-0005c80d81a2f3f8.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000b4b6-0005c80c9979b637.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000a7ca-0005c80bb0d1ff50.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000009ade-0005c80ac8242caf.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000008e05-0005c809dfaf56fb.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000008118-0005c808f6e12c0d.journal
PASS: /run/log/journal/69357476ee55415c8407fc9f84dc235d/system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000742e-0005c80806b00481.journal
$ ls -alh /run/log/journal/69357476ee55415c8407fc9f84dc235d/
total 55M
drwxr-s---+ 2 root systemd-journal 260 Jul 27 11:53 .
drwxr-sr-x 3 root systemd-journal 60 Jul 26 15:42 ..
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 02:08 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000742e-0005c80806b00481.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 03:13 system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000008118-0005c808f6e12c0d.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 04:18 system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000008e05-0005c809dfaf56fb.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 05:23 system@93c2aae90b5b4ecaacf0d7339c8f33b2-0000000000009ade-0005c80ac8242caf.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 06:28 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000a7ca-0005c80bb0d1ff50.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 07:33 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000b4b6-0005c80c9979b637.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 08:38 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000c18f-0005c80d81a2f3f8.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 09:43 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000ce71-0005c80e6a86dafe.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 10:48 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000db61-0005c80f5363b862.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 11:53 system@93c2aae90b5b4ecaacf0d7339c8f33b2-000000000000e845-0005c8103bd20432.journal
-rw-r-----+ 1 root systemd-journal 5.0M Jul 27 12:18 system.journal
那么为什么以及如何 journald 使用 359 倍的空间来存储轻易压缩到 153K 的内容?
什么东西占用了 99.8% 的空间?有没有办法以牺牲这 99.8% 的空间为代价来存储更多的数据?