Re: Recording usage without write permission

On Wed, 18 Oct 2023 09:23:54 -0400, Michael F. Stemper <[email protected]> wrote:
> Looking at the man page for systemd-journald, I see the following:
>
>    By default, each logged in user will get her/his own set of journal
>    files in /var/log/journal/.
>
> Does this mean that logging would only work when I was logged in, and that
> all of the journal files would disappear when I logged out? Or, would the fact
> that my daemon was running (or lurking) count as me being logged in?
> Although after reading that man page, I also realized that the daemon approach
> probably would not have been practical for me. There were somewhere between
> forty and fifty boxes on that network. I would have needed to kick off a
> daemon on each of them, and also set up something to gather the results from
> each box's /var/log/journal/ to a common location (my $HOME).
>
> None the less, interesting new knowledge.

There is one daemon, systemd-journald running for the computer. It handles
creating system level and user level journal entries.

All entries go into the system level journal files. For a user who has logged
in at least once (even if only via ssh), there are also user level journal files
that duplicate the entries relevant for that user.

User's who don't log in are usually tied to a specific service. For example
for sddm, the kde plasma display manager, to view it's entries use
"journalctl  _SYSTEMD_UNIT=sddm.service".

Even though the sddm user doesn't have it's own journal files, the entries are
still available from the system level journal files.

One thing I don't like, is the default size of the journal files is based on
a percentage of the size of the file system where /var/log/journal is stored.
I always limit it using ...
$ cat /etc/systemd/journald.conf.d/journald.conf
[Journal]
SystemMaxUse=200M
RuntimeMaxUse=200M
ForwardToSyslog=yes
ForwardToConsole=yes
TTYPath=/dev/tty12

For my use, that's normally about 5 weeks of data. I don't need years of data,
which not only takes a lot of space, it slows down looking for data.

Regards, Dave Hodgins