On a space-constrained embedded device used as a gateway (PC Engines
APU2 with 60GiB SSD) I recently noticed that several services journal
logs only had last few days entries in them; usually the logs would
cover several recent boot sessions over several months.
Due to the space constraints the host is configured thus:
dev/mapper/VG_SSD-var 7.8G 5.8G 1.6G 79% /var
# journald.conf
SystemMaxUse=2500M
SystemKeepFree=1G
I found the journal using the maximum:
2.5G /var/log/journal/2b91f3a904674a7698f80c698fd76904
Eventually I tracked it down using
journalctl --follow
that shows mdns-reflector writing at least 12 messages per second.
Reviewing the default configuration I found:
LOGGING_LEVEL=info
I've now changed it to
LOGGING_LEVEL=warning
and I'd recommend that the Debian package adopts this change too.
I'm reporting it to upstream but since that repository does not appear
to have been changed in 3 years it may not get acted on upstream.