What were you trying to do that didn't work?
Have each journal file to be rotated only when its size+time limit is reached, and not when another user's journal reaches a size limit.
This can cause all events from other users or even the system to be pruned via automatic rotation of journals.
Please provide the package NVR for which bug is seen:
systemd-239-78.el8.x86_64, maybe other versions as well
How reproducible:
Always
Steps to reproduce
- Create a configuration drop-in
- # mkdir -p /etc/systemd/journald.conf.d/
- # vi /etc/systemd/journald.conf.d/journald.conf
- [Journal]
Storage=persistent
SplitMode=uid
RateLimitBurst=0
- Restart systemd-journald
- # systemctl restart systemd-journald.service
- Log in to the system as an unpriviledged user and generate a exaggerated amount of log records (to reproduce it faster)
- # ssh user@localhost
- $ id user
uid=1000(user) gid=1000(user) groups=1000(user) - $ while true; do head -c 512 /dev/urandom | base64 | logger; done
Expected results
Only user-1000@*.journal files to be rotated when its journal file reaches the defined/default size limit.
Actual results
All journals files gets rotated whenever the user-1000 (user) reaches the size limit on any single journal file.