Ever since Debian went to Journalctl for logging, its become a pain it the ass.
Reason I say this is even though I keep growing the amount of data it retains, it never seems to be enough. My issue is that I would like to keep say 6 months of email logs, but the system flushes the logs once they reach 16GB at this point.
I did some research and discovered that you can break away the postfix and dovecot logs from journalctl and run them as a classic logrotate system as it used to be prior to journalctl coming on to the scene.
I know how to do it, it requires rsyslog to be installed and configured. But I would like to ask if you could tell me how to configure it in the virtulalmin/Webmin System logs so that I don’t have to search for it using the CLI or if you could work into the interface the ability to enable this side of the logging so that it can be easily accessed?
I’ve never found that to be an issue with how big disks have gotten, I just configure the journal to keep logs for a long time.
But, also, fix services that are chattery. Most of the time, when I find the journal being rotated quicker than I would expect based on how much space I’ve given it, it’s because some service has errors that lead to a lot of chatter. Fixing those problems resolves that problem. A lot of folks just ignore logs entirely, or ignore the ones they don’t understand.
Anyway, to be clear: We have no intention of changing how your OS logs, we try very hard to use the system in the way it was designed to be used by the OS vendor. We use the native package format and repos, we use config files in their native locations, if there are template units that can do the job we need done for services that get custom config for each use we try to use that, etc. Your OS chose to log to the journal, you chose your OS, and we respect both of those choices.
But, nothing is stopping you from configuring some or all services to log to text files. I think you give up a lot by doing so, but it’s your decision. We provide tools for both, but you’ll need to configure anything custom yourself.
webmin itself chatters a lot try running journalctl -u webmin and there are a lot of entries like
Apr 30 08:43:14 server.microsoft.com su[1885781]: (to panel) root on none
Apr 30 08:43:14 server.microsoft.com su[1885781]: pam_unix(su:session): session opened for user panel(uid=1075) by (uid=0)
Apr 30 08:43:14 server.microsoft.com su[1885781]: pam_unix(su:session): session closed for user panel
the more virtual servers you have the more entries you have, perhaps webmin doesn’t need to log those
no problem with chattery logs.
better to have useful information in the logs than nothing at all.
far too many just ignore them or just seek an explanation
it’s a pain when you are tailing the journalctl output as you may lose the information (off screen) before you have had chance to view it. parsing the output is not so much of a problem
