Is there a way to get the size of logs (in bytes) which journalctl creates per day?
Background: we want to get our logs into a central database.
But before doing this I would like to have rough estimate how much bytes will get transferred.
My question to journalctl in humang language: "Dear journalctl, how many bytes of logs did you create during the last 24 hours?".
How to ask this question journaltcl?
Best Answer
Typically the manual is much better at providing answers in human friendly languages...
man journalctl
That suggests that there is more than one file but doesn't give the sizes of individual logs files or the granularity you want.
Now where would the actual log files be?
Nearly every manual ends with a section SEE ALSO:
Let's try
man systemd-journald.service
first (an educated guess):As a first level approach check how data much is actually stored per day in either/both of those directories:
find /run/log/journal/ -type f -ls
If you don't see files older than today or yesterday journald probably records a lot of data and the files are rolling over...
You may want to tune that in
/etc/systemd/journald.conf
so that more will be stored and you can get an idea of the total amount data that gets generated and collected.If you do get a lot of journal data probably you will also want to investigate the source and will need to decide of it is (potentially) useful to continue to collect that data or maybe you should tune something that's too verbose to become less so.