more logging configuration

_toc.yml

@@ -57,7 +57,7 @@ chapters:
           - file: admin-guide/configuration/alternative_desktops
           - file: admin-guide/configuration/central_logging_elastic
           - file: admin-guide/configuration/syslog_forwarding
-          - file: admin-guide/configuration/journal
+          - file: admin-guide/configuration/journald
           - file: admin-guide/configuration/metrics_telegraf
           - file: admin-guide/configuration/ntp_server
           - file: admin-guide/configuration/ssh_host_hopping

admin-guide/configuration.md

@@ -30,6 +30,8 @@ Here starts a so far small collections of configuration guides for sysadmins of
 
 ## Logging
 - [Setup Central Logging to Elastic](configuration/central_logging_elastic)
+- [Syslog Forwarding](configuration/syslog_forwarding)
+- [Journald Tuning](configuration/journald)
 
 ## Metrics
 - [Metrics Collection - Configuration Telegraf](configuration/metrics_telegraf)

admin-guide/configuration/journald.md

@@ -0,0 +1,25 @@
+# Journald Tuning
+
+For the systemd journal size restriction and rate limiting can be fine tuned.
+
+## Size Restricion
+
+In Hiera `log_client::journal_system_max_use` (default `50%`) limits the total size of the journal, whereas `log_client::journal_system_keep_free` (default `25%`) ensures how much disk space is keep free in `/var/log` for other use. In addition to the syntax described in [journald.conf(5)](https://www.freedesktop.org/software/systemd/man/latest/journald.conf.htm) (bytes or use K, M, G, T, P, E as units) we also support percentages, i.e. `25%` means that the journal will use mostly/spare at least 25% of `/var/log`. Note that for the use of a percentage limit `/var/log` must be an own partition, else absolute values need to be set.
+
+`log_client::journal_system_max_file_size` limits the size of an individual journal file. Default ist `32M`.
+
+If there is no need for a persistent log at all, it can be disabled with
+```
+log_client::persistent_journal: false
+```
+
+## Rate Limiting
+
+In Hiera `log_client::journal_rate_limit_burst` defines how many messages of a service are at least logged in the interval period (default 30s). Note that the [actual limit depends on the available disk space](https://www.freedesktop.org/software/systemd/man/latest/journald.conf.html#RateLimitIntervalSec=) The default is `10000` messages.
+
+So `log_client::journal_rate_limit_interval` defines the above mentioned interval period. Allowed time units are `s`, `min`, `h`, `ms` and `us`. If not specified seconds are assumed.
+
+Rate limiting is disbled with
+```
+log_client::journal_rate_limit_interval: 0
+```