One log line, tens of kilobytes written: the systemd-journald argument flares up again

A bug report has appeared on systemd's GitHub (issue #40262) whose author contends that the systemd-journald daemon creates a disproportionately large disk load compared with classic syslog. The title puts the problem in sharp relief: writing a single log line turns into 49 KB or more of actual writes to disk on ext4, and over 110 KB on btrfs.

What the author observed

As an example, he cites a virtual machine running Debian 13 (systemd 257.9, kernel 6.12.57, XFS file system) on which haproxy writes roughly two log lines per second. With activity that modest, the VM shows about 50 I/O operations per second — meaning each written line accounts for noticeably more disk accesses than you might expect.

The author deliberately chose a virtual machine as the platform for his measurements. According to him, in a previous discussion of a similar problem (issue #15292, closed, as he sees it, for no clear reason) the complaints were dismissed with the argument that iotop is inaccurate and that the surplus operations are supposedly generated by the kernel itself when it merges writes. Figures at the VM level, he maintains, reflect the traffic after all the kernel's machinery has done its work — which means the issue is not that “the kernel inflates the IOPS count,” but that journaling is simply slow in and of itself.

Complaints about the format

The report's central point is that journald uses an extremely inefficient storage format: journal files turn out to be several times larger than the volume of data actually written into them. Along the way, the author voices a long-standing grievance against journald — in his experience, an unclean reboot corrupts the journals often enough to speak of the binary format's insufficient robustness.

He frames the expected behavior plainly: the volume written should be within the same order of magnitude as syslog's.

Status

At the time of publication the issue is tagged with the bug label and remains open, with no assignee. The report points back to an earlier, closed discussion of the same subject — which makes this conversation more a continuation of a long-running argument about the price systemd's binary journal charges for its log-indexing and structuring capabilities than a sudden revelation.

Source: Hacker News