linda

1、查看systemd journal日志大小，缺省是硬盘的10%，具体位置在/var/log/journal。如果硬盘大，会导致内存占用大

# journalctl --disk-usage
Archived and active journals take up 304.0M in the file system.

# du -h /var/log/journal
305M    /var/log/journal/82c53a209c730d440ac137a1616d19be
8.1M    /var/log/journal/2127311e42c6414cb24a0ce959fdfd6f
313M    /var/log/journal

# systemctl status systemd-journald
     ...
     Memory: 1.3M
     
2、编辑 /etc/systemd/journald.conf文件，设置systemd journal日志固定大小

[Journal]
SystemMaxUse=250M
SystemMaxFileSize=50M

3、重启生效

systemctl restart systemd-journald


4、查看状态

# systemctl status systemd-journald

# s
USER        PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
...
root     2671288  0.0  1.9 108596 19796 ?        S<s  20:00   0:00 /lib/systemd/systemd-journald


# journalctl -n --no-pager


参考：
https://wiki.manjaro.org/index.php/Limit_the_size_of_.log_files_%26_the_journal
https://www.loggly.com/ultimate-guide/managing-journal-size/
https://manpages.debian.org/testing/systemd/journald.conf.5.en.html
http://www.jinbuguo.com/systemd/journald.conf.html

========
查看以前的日志

journalctl --list-boots
journalctl -b -1

参考：https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-systemd-logs

[ 本帖最后由 linda 于 2022-3-13 08:10 编辑 ]