Configuring the systemd journal for persistence in RHEL7

Configuring the systemd journal for persistence in RHEL7

By default, the journal doesn't store log files on disk, only in memory or the /run/log/journal directory. This is sufficient for the recent log history (with the journal) but not for long-term log retention should you decide to go with journal only and not with any other syslog solution.

Configuring journald to keep more logs than memory allows is fairly simple, as follows:

Open /etc/systemd/journald.conf with your favorite text editor with root permissions by executing the following command:

vim /etc/systemd/journald.conf

Ensure that the line containing Storage is either remarked or set to auto or persistent and save it, as follows:

[root@nsk ~]# vim /etc/systemd/journald.conf

#  This file is part of systemd.

...

..

[Journal]

Storage=auto

If you select auto, the journal directory needs to be manually created. The following command would be useful for this:

[root@nsk ~]# mkdir -p /var/log/journal

[root@nsk ~]#

Now, restart the journal service by executing the following command:

[root@nsk ~]# systemctl restart systemd-journald

There are many other options that can be set for the journal daemon.

By default, all the data stored by journald is compressed, but you could disable this using Compress=no.

It is recommended to limit the size of the journal files by either specifying a maximum retention age (MaxRetentionSec), a global maximum size usage (SystemMaxUse), or a maximum size usage per file (SystemMaxFileSize).