Re: [gentoo-user] syslog-ng: how to read the log files

["Canek Peláez Valdés" <caneko@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1679 bytes --]

On Wed, Feb 18, 2015 at 12:22 PM, <gottlieb@nyu.edu> wrote:
>
> On Tue, Feb 17 2015, Canek Peláez Valdés wrote:
>
> > On Tue, Feb 17, 2015 at 2:29 PM, <covici@ccs.covici.com> wrote:
> >>
> >> I wonder if the OP is using systemd and trying to read the journal
> >> files?
> >
> > Those live under /var/lib/journal (which you need to create; Gentoo
doesn't
> > do it by default last time I saw),
>
> Wow!  I just checked and indeed I do not have /var/lib/journal.
> I run systemd (thanks to canek) and use journalctl, which I *thought*
> was displaying the journal).

The journal works without permanent storage (one more of its many
advantages); in that case, it keeps a small amount of logs in memory (you
can set how much memory to reserve for it).

> Need I make some changes?

Only if you want to have logs in permanent storage. In that case, you only
need to create the /var/log/journal dir with systemd-journal GID, and 2755
permissions (with setgid). systemd-journald will automatically rotate the
logs when they use 10% of the free disk available (you can also change
that).

Since the logs are compressed and indexed, each entry on them is accesible
in O(1), and they don't use that much space (with 280 megabytes reserved in
my laptop for journal logs, I have logs since Sep 20, 2014; that's 5 months
worth of logs, although my laptop doesn't run that many daemons).

Anyway, the journal works perfectly without permanent storage (as you can
see); if you are happy that way, you don't need to enable it.

Regards.
--
Canek Peláez Valdés
Profesor de asignatura, Facultad de Ciencias
Universidad Nacional Autónoma de México

[-- Attachment #2: Type: text/html, Size: 1974 bytes --]