Issue Extending the storage time for journald log retention does not work.

[W4ru]

Server operating system version

Ubuntu 24.04.3 LTS

Plesk version and microupdate number

Plesk Obsidian 18.0.74 Update 2

Scenario:

I use Warden and like to fine-tune the Amavis log files to further improve my filters.

Unfortunately, I only have access to the last four to five days. After doing some research, I made changes that affect journal log retention.

cat /etc/systemd/journald.conf

[Journal]
Storage=persistent
#Compress=yes
#Seal=yes
SplitMode=uid
#SyncIntervalSec=5m
#RateLimitIntervalSec=30s
#RateLimitBurst=10000
SystemMaxUse=2G
#SystemKeepFree=25%
#SystemMaxFileSize=100M
#SystemMaxFiles=100
#RuntimeMaxUse=10%
#RuntimeKeepFree=
#RuntimeMaxFileSize=
RuntimeMaxFiles=100
MaxRetentionSec=6month
MaxFileSec=1month
#ForwardToSyslog=no
#ForwardToKMsg=no
#ForwardToConsole=no
#ForwardToWall=yes
#TTYPath=/dev/console
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#MaxLevelWall=emerg
#LineMax=48K
#ReadKMsg=yes
#Audit=yes
#AutoFlush=yes

But after a week of the changes being in effect (service restart, server restart), there is no change to be seen. Only 4-5 days remain.

journalctl --disk-usage
Archived and active journals take up 798.0M in the file system.

Where is the error? Have I overlooked something, or is there another setting that needs to be adjusted?
Grateful for any advice.

 

[Hangover2]

@W4ru

If this is a shared hosting system, it is likely that the issue is caused by SystemMaxFiles.
systemd-journald creates separate journal files per user, and if you have many of them, RuntimeMaxFiles=100 becomes the bottleneck.
Journald deletes old files as soon as the total number of journal files (system + user) reaches 100, so SystemMaxUse=2G will not matter.

Run the following command to check whether this is the case:

ls -lh /var/log/journal/*/*.journal | wc -l

If the result is 100, this is why you only see around 4–5 days of logs.
In that case, a good starting point could be:

SystemMaxFileSize=256M
SystemMaxFiles=4096
SystemMaxUse=8192M

 

[W4ru]

Thannk You @Hangover2 !
The command in question returns 100.
I have therefore changed the settings, restarted the service, and now there is a need to wait a little while....
I will inform as soon as changes are visible here.