journalctl reports truncated files after logrotate.service runs

[MrJake222]

Hi,

 

My journald logs are limited to last midnight. I figured out it's related to logrotate.service. When I run it with couple of logs present in /var/log/journal (and passing all tests) they become 0-sized. Then:

$ journalctl --verify
Journal file /var/log/journal/xxx/system.journal is truncated, ignoring file.
PASS: /run/log/journal/xxx/system.journal      

$ ls  /var/log/journal/xxx -lsh          
total 0
0 -rw-r-----+ 1 root systemd-journal 0 Feb 26 12:10 system@141d4d3509d94af8aeecc18c6e8eec9a-0000000000000001-0005f58e34f3a6c8.journal
0 -rw-r-----+ 1 root systemd-journal 0 Feb 26 12:10 system.journal

 

I've discovered that /var/log/journal is a symlink to /var/log.hdd/journal. How can I stop this from happening to my logs? I love the convenience of journalctl command.