I upgraded to 13.2/KDE recently, then some time later noticed that my system log files were not rotating properly.
After spending time in these two forum items
https://forums.opensuse.org/showthread.php/503896-What-runs-logrotate-in-OpenSUSE-13-2https://forums.opensuse.org/showthread.php/506799-systemd-and-journald-Looking-for-setup-suggestions
I have concluded that for those running systemd journaling, whether you know it or not, your setup might need attention.
In my case, I have upgraded since 11.x using zypperdup method. As a result, my installation has rsyslog installed.
As of 13.2, if your do a clean install, rsyslog is no longer installed unless you manually install it. System logging is now handled by systemd-journald.
If you are like me and update, logging is still managed by systemd-journald, but if rsyslog is installed in your system log messages are also forwarded to /var/log/messages in the ‘traditional’ manner.
Systemd-journald accumulates messaging in a database, rather than a text file. By default, the journal database is volatile and deleted on shutdown. This volatility can be overridden and the database will accumulate in /var/log/journal/ if that directory exists.
These man pages are helpful,
man journalctl
man journald.conf
as is this Arch Linux systemd item.
At issue for me is the default configuration for journald, found in /etc/systemd/journald.conf
# cat /etc/systemd/journald.conf.oldcjm
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
#
# See journald.conf(5) for details
[Journal]
#Storage=auto
#Compress=yes
#Seal=yes
#SplitMode=login
#SyncIntervalSec=5m
#RateLimitInterval=30s
#RateLimitBurst=1000
#SystemMaxUse=
#SystemKeepFree=
#SystemMaxFileSize=
#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=
#MaxRetentionSec=
#MaxFileSec=1month
#ForwardToSyslog=yes
#ForwardToKMsg=no
#ForwardToConsole=no
#TTYPath=/dev/tty10
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
I assume the format of this file shows the default values in effect, although each of these settings are commented in this file.
Key settings for this discussion include
#SystemMaxUse= Sets the maximum disk usage for the folder /var/log/journal - NOT SET
#MaxRetentionSec= Sets the maximum 'time-depth' for the journal database - NOT SET
#MaxFileSec=1month Sets the maximum time span for each database component file
#ForwardToSyslog=yes As discussed, rsyslog was installed in my system when systemd was updated so the pass on to /var/log/messages is ON
With current installs, systemd persistent journaling (/var/log/journal/ exists) is not enabled by default, but i found it was installed and running on my system.
What I found was that this directory was now consuming 1.3GB, had monthly database component files all the way back to 2012 and when I ran journalctl the first time, I had system journaling all the way back to late 2011, likely when systemd was first introduced (? it does not seem that long ago, but).
I have now modified /etc/systemd/journald.conf to have
SystemMaxUse=100M
MaxRetentionSec=3month
and then executed
systemctl daemon-reexec
to restart systemd( a reboot would work as well).
After about 6 hours runtime, I have not observed any changes to the old database files in /var/log/journal/. It is unclear from the available man pages if in fact systemd will ‘clean-up and remove’ those files older than 3 months. I plan to give it 24 hours, then begin to manually delete the old database files.
My initial usage of journalctl to review logs finds it quite comprehensive, with a bit of a learning curve.
I highly recommend users review journald and journalctl and the new capabilities they introduce.
I also suggest a check for the existence and size of the /var/log/journal/ directory and take appropriate action.
As I read and understand the documentation, simply deleting the /var/log/journal/ directory will stop systemd persistent journaling.