Re: [gentoo-user] syslog-ng: how to read the log files

On Wed, Feb 18 2015, Canek Peláez Valdés wrote:

> On Wed, Feb 18, 2015 at 12:22 PM, <gottlieb@×××.edu> wrote:
>>
>> On Tue, Feb 17 2015, Canek Peláez Valdés wrote:
>>
>> > On Tue, Feb 17, 2015 at 2:29 PM, <covici@××××××××××.com> wrote:
>> >>
>> >> I wonder if the OP is using systemd and trying to read the journal
>> >> files?
>> >
>> > Those live under /var/lib/journal (which you need to create; Gentoo
>> > doesn't do it by default last time I saw),
>>
>> Wow!  I just checked and indeed I do not have /var/lib/journal.
>> I run systemd (thanks to canek) and use journalctl, which I *thought*
>> was displaying the journal).
>
> The journal works without permanent storage (one more of its many
> advantages); in that case, it keeps a small amount of logs in memory (you
> can set how much memory to reserve for it).
>
>> Need I make some changes?
>
> Only if you want to have logs in permanent storage. In that case, you only
> need to create the /var/log/journal dir with systemd-journal GID, and 2755
> permissions (with setgid). systemd-journald will automatically rotate the
> logs when they use 10% of the free disk available (you can also change
> that).
>
> Since the logs are compressed and indexed, each entry on them is accesible
> in O(1), and they don't use that much space (with 280 megabytes reserved in
> my laptop for journal logs, I have logs since Sep 20, 2014; that's 5 months
> worth of logs, although my laptop doesn't run that many daemons).
>
> Anyway, the journal works perfectly without permanent storage (as you can
> see); if you are happy that way, you don't need to enable it.
>
> Regards.
> --
> Canek Peláez Valdés

Thank you for another lucid explanation.
allan