On Mon, 21 Oct 2019 at 00:32, home user <mattisonw@comcast.net> wrote:
> The key to getting good answers is to ask good questions.
Apparently, I'm not quite asking "good questions" this weekend.

I was looking for a more integrated view of journald so I could differentiate the advice given in this thread, and see how the two approaches provided in this thread converge or diverge.  (Why do I feel like a mathematician right now?)  None of the 4 sources:
the Fedora sys. admin. guide, the digitalocean tutorial, the journalctl man page, and the journald.conf man page
quite do it, sepaarately or together.

For review, the two approaches are:
A. using journald.conf to customize journald, and
B. (1) "journalctl --flush --rotate"; (2) "rm -rfv /var/log/journal/*/*@*"; (3) "journalctl --update-catalog --sync".
 

My first question:
If I use journald.conf to, say (hypothetical values for now):
* have the system start a new journald file each day, and
* delete journald files once they're a month old,
would I still need to do B above, or will A automatically cause the clean-out of all journald files more than a month old (maybe the next day or after a reboot)?

The biggest log file messes I have seen came from some errant process dumping huge amounts of data into the logs in a matter of hours (Murphy's Law ssys this will usually occur over long weekends), so daily cleanups aren't adequate.   Journald supports both rate limiting and size controls (free space and total space for journald files).


Second question:
What is the preferred way of changing the journald configuration?  That is, is there some GUI or tool for that, or do I simply edit "/etc/systemd/journald.conf" using my favorite editor (vi)?

Third question:
My impression is that approach B is only a temporary fix; "/var/log/journal/" would eventually get huge again.  Am I correct?

Yes -- disks want to be full: the price of free space is eternal vigilance.

--
George N. White III