Path: news.eternal-september.org!eternal-september.org!feeder3.eternal-september.org!nntp-feed.chiark.greenend.org.uk!ewrotcd!nntp.terraraq.uk!.POSTED.tunnel.sfere.anjou.terraraq.org.uk!not-for-mail
From: Richard Kettlewell <invalid@invalid.invalid>
Newsgroups: comp.os.linux.misc
Subject: Re: More systemdCrap
Date: Thu, 13 Mar 2025 07:47:23 +0000
Organization: terraraq NNTP server
Message-ID: <wwvjz8tqsms.fsf@LkoBDZeT.terraraq.uk>
References: <vqn41l$1efis$1@dont-email.me>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Injection-Info: innmantic.terraraq.uk; posting-host="tunnel.sfere.anjou.terraraq.org.uk:172.17.207.6";
	logging-data="98194"; mail-complaints-to="usenet@innmantic.terraraq.uk"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux)
Cancel-Lock: sha1:bSRJqMuc00QQhivjZBebPq4h6zY=
X-Face: h[Hh-7npe<<b4/eW[]sat,I3O`t8A`(ej.H!F4\8|;ih)`7{@:A~/j1}gTt4e7-n*F?.Rl^
     F<\{jehn7.KrO{!7=:(@J~]<.[{>v9!1<qZY,{EJxg6?Er4Y7Ng2\Ft>Z&W?r\c.!4DXH5PWpga"ha
     +r0NzP?vnz:e/knOY)PI-
X-Boydie: NO

The Natural Philosopher <tnp@invalid.invalid> writes:
> I have an errant service spewing out pages of errors.
>
> It appears that journalctl is not able to clear a single service from
> its log files.
> Anyone know different?

Pass.

An approach that might suit you better:
* Send all the logs to syslog.
* Read/filter/delete the syslog files in the traditional way, instead of
  using journalctl.
* Optionally, set the journal size to something small since you won’t be
  using it much.

This used to be a standard configuration in Debian but I think they’ve
changed the default now.

There’s two ways to do it:
1) Have journald forward to syslog.
2) Have syslog read from the journal.

The paragraph at the bottom of
https://www.freedesktop.org/software/systemd/man/latest/journald.conf.html
discusses the differences. I think option #2 would usually be the better
choice, since it reduces the chance of missed messages.

https://www.loggly.com/ultimate-guide/centralizing-with-syslog/
describes how to set up both approaches. “Using imjournal” corresponds
to option #2.

-- 
https://www.greenend.org.uk/rjk/