I configured my journald with "MaxRetentionSec=7day". The docs say:
"The maximum time to store journal entries." So, naturally, I assumed
that my logs go back 7 days.
Of course, it was my fault. The docs also say (in the next sentence):
"This controls whether journal files containing entries older then the
specified time span are deleted."
In other words, an entire journal file will be deleted if there's just
one entry in it older than seven days? Is that it? This kills *A LOT*
of log entries, not just the ones older than seven days.
Okay, so I must set "MaxFileSec=1h" or something? That might work,
because it tells journald to switch to a new file, even if the old one
isn't full yet.
Okay, fine, but journald allocates a full 8 MB file at once. With one
file per hour and seven days worth of logs, I'll end up with 1.3 GB of
mostly empty log files?
I must have gotten something wrong here. This feels very, very wrong.
Maybe set "MaxFileSec=1d" and "MaxRetentionSec=8day"?
Well, the docs also say that "normally, time-based rotation should not
be required", so maybe they simply didn't "optimize" use cases where
you actually limit log files on a time basis ...
