I have one question regarding to the following part to redirect journel to storage. I understand every step. However, I don't understand why after you killed the process, the system will know to put the new journal into the new folder instead of the old one. Can someone help? Thanks.
Create the directory /var/log/journal.
[root@demo ~]# mkdir /var/log/journal
Set the group ownership of the new directory to systemd-journal, and the permissions to 2755.
[root@demo ~]# chown root:systemd-journal /var/log/journal [root@demo ~]# chmod 2755 /var/log/journal
Inform systemd-journald that the new location should be used by sending a USR1 signal to it. A reboot will also suffice.
[root@demo ~]# killall -USR1 systemd-journald
Ok i will try to explain.
With killall command you can not only terminate process. But send it a signal to do something.
In this command
killall -USR1 systemd-journald
you tell process systemd-journald.
Hey proccess! I just created for you a new good warm place to write your logs! Please move all your already collected log data to /var/log/journal/<guid> permanent hard disk place. New data keep in this place too.
You can restart systemd-journald too. But then you will loose already collected logs.
Please correct me if i made a mistake.