I set Storage=volatile and the ForwardToSyslog=true, so that no logs are written to disk, saving I/O and disk space, but the journal has the logs since boot. Rsyslog+RELP gets the logs over to my collector and phpLogCon is what I review the logs with.
HTH, Brendan On Thu, Jun 29, 2023, 6:56 PM Dave Close via rsyslog < rsyslog@lists.adiscon.com> wrote: > I wrote: > > >I have eight machines, three laptops, three desktops, and two virtual, > >all running Fedora 38, fully updated. All of them include systemd, > >of course, and all are also running rsyslog. Seven of them update > >log files in /var/log as configured by rsyslog.conf, one does not. I > >can't find *any* difference in the configuration between that one > >and the others. > > >I've looked at rsyslog.conf and the systemd service files for rsyslog > >and systemd-journald. I've checked the active systemd units and, > >while there are differences, none that seem relevant (mostly different > >devices, etc). > > >When I say there are no logs in /var/log, I really mean that they are > >empty. /var/log/messages, for example, does contain about 900 lines > >from the last time the machine was rebooted but nothing else. After > >logrotate runs, /var/log/messages is completely empty. Other empty > >files include boot.log, cron, maillog, sa-update.log, secure, spooler, > >and all the logs in the anaconda, cups, httpd, and sssd subdirectories. > > Problem solved. Apologies for the bandwidth but good to know people > are here to help when needed. > > I had overlooked that there was a one-character change to > /etc/systemd/journald.conf. The comment character at the start of > the line, "Storage=none", had been removed. Restoring that character > and restarting journald seems to have fixed the issue. > > I must have made this change a long time ago, probably out of concern > by the disk storage occupied by the journal. But as I recall, the > documentation said only that changing this would reduce disk usage, > not that it would stop the journal from running entirely. And if it > were still running, it should still be able to pass data to rsyslog. > -- > Dave Close, Compata, Irvine CA +1 714 434 7359 > d...@compata.com dhcl...@alumni.caltech.edu > "Controlling complexity is the essence of computer programming." > -- Brian Kernighan > > > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
