/var/log/qubes/* disk usage: logrotate and decrease debug log level ?

[taradiddles]

Qubes OS version:

R4.0rc4

---

Expected behavior:

• /var/log/qubes/*disp* log files (and maybe more generally all log files in this dir) should be compressed/rotated and old files ultimately deleted.
• There should be a knob to decrease the debug log level of guid* and qmmeman.

Actual behavior:

• With the new random disp VM numbering the log dir ends up being cluttered with dispXXXX files. They should be deleted after some time (one month ?)
• Some log files are huge - see below. Total size is likely not a concern in itsef compared to what VMs use, but outputting thousands of lines over the course of a short dispvm usage isn't I/O friendly for people without SSDs.

1.2M Feb 13 18:59 guid.disp4856.log
1.2M Feb  9 21:25 guid.win7new.log.old
2.5M Feb 17 12:47 guid.disp3860.log
3.0M Feb 10 09:55 guid.disp6293.log
3.2M Feb 15 11:12 guid.disp9183.log
3.3M Feb 17 14:04 guid.disp4857.log
4.5M Feb 17 14:04 guid.disp230.log
5.5M Feb 11 13:25 guid.disp1576.log
5.6M Feb 14 13:40 guid.disp3318.log
8.9M Feb 17 20:43 guid.disp9486.log
11M Feb 10 18:34 guid.disp6497.log
11M Feb  9 17:49 guid.disp6934.log 
12M Feb 10 15:39 guid.disp132.log 
14M Feb 16 20:18 guid.disp8740.log
30M Feb 10 18:34 guid.disp7365.log
31M Feb 11 23:38 guid.disp60.log
34M Feb 18 09:08 qmemman.log
36M Feb 15 14:38 guid.disp7765.log
60M Feb 15 23:39 guid.disp3787.log

wc -l guid.disp3787.log : 763074 !

system uptime: < 2 days.

---

Related issues:

[3hhh]

Totally supporting this statement.

My /var/log/qubes is currently 1.3G large, /var/log/journal 3.6G.

Both should have some reasonable limits set: From my point of view only the last 10 boot sessions or so should be deemed relevant.

Since these defaults slow down e.g. journalctl significantly I'd also consider this a bug rather than a feature request.

Related qubes-users discussion: https://groups.google.com/forum/#!topic/qubes-users/xuqbv-oR5iQ

[3hhh]

Totally supporting this statement.

My /var/log/qubes is currently 1.3G large, /var/log/journal 3.6G.

Both should have some reasonable limits set: From my point of view only the last 10 boot sessions or so should be deemed relevant.

Since these defaults slow down e.g. journalctl significantly I'd also consider this a bug rather than a feature request.

Related qubes-users discussion: https://groups.google.com/forum/#!topic/qubes-users/xuqbv-oR5iQ

[3hhh]

Users can set the respective options in /etc/systemd/journald.conf themselves in the meantime, use journalctl --vacuum-size=100M && journalctl --verify as well as something such as find /var/log/qubes/* -mtime +5 -exec rm {} \; as cron job to clean the qubes logs regularly.

For the qubes logs however I guess that logrotate would be more optimal.

[3hhh]

Users can set the respective options in /etc/systemd/journald.conf themselves in the meantime, use journalctl --vacuum-size=100M && journalctl --verify as well as something such as find /var/log/qubes/* -mtime +5 -exec rm {} \; as cron job to clean the qubes logs regularly.

For the qubes logs however I guess that logrotate would be more optimal.