Keep Steam Runtime's logger out of the journal

Steam's srt-logger runs inside steam-backlog-enforcer.service's cgroup
and mirrors Steam's console into journald on its own — the DEVNULL
stderr the spawn already uses does not reach it, and the env carried
SRT_LOG_TO_JOURNAL=0, which is not the variable it reads. One boot on
2026-09-12 wrote 481k "joystick FFB effect status" lines (99% of the
journal) and evicted two weeks of history from a 300M journal, along
with the evidence for that night's curfew failure.

- desktop_env_args(): SRT_LOGGER_USE_JOURNAL=0, the variable srt-logger
  actually honours. Steam keeps its own logs/console-linux.txt.
- Unit: LogFilterPatterns for the two known flood patterns plus a
  per-unit rate limit, so a future Steam that ignores the variable still
  cannot take the journal with it.

The unit file is deployed and daemon-reloaded; the running service is
not restarted, because Steam is its child and a restart would kill a
live game. The env fix takes effect on the next enforcer start.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015mLnUeoJ3mUwGRTowTUH6d
This commit is contained in:
Krzysztof Rudnicki 2026-09-13 10:51:50 +02:00
parent 2d45515665
commit a5abb94d85
3 changed files with 26 additions and 0 deletions

View File

@ -16,6 +16,15 @@ Environment=STEAM_ENFORCER_DESKTOP_USER=__DESKTOP_USER__
Environment=DISPLAY=:0
# Hardening: enforcer must not be easily killed.
OOMScoreAdjust=-900
# Journal backstop. Steam's srt-logger runs in this unit's cgroup and mirrors
# Steam's console into journald; 2026-09-12 it wrote 481k "joystick FFB"
# lines in one boot (99% of the journal) and evicted two weeks of history.
# SRT_LOGGER_USE_JOURNAL=0 in the spawn env is the fix at source; these two
# make sure a future Steam that ignores it still cannot flood the journal.
LogFilterPatterns=~Failed to get joystick[0-9]+ FFB effect status
LogFilterPatterns=~FFBInterface
LogRateLimitIntervalSec=1min
LogRateLimitBurst=2000
#
# DO NOT ADD PrivateMounts=, PrivateTmp=, ProtectSystem= OR ProtectHome= HERE.
# The daily gaming budget enforces its cutoff by bind-mounting a refusal stub

View File

@ -70,6 +70,13 @@ def desktop_env_args(user: str, uid: int) -> list[str]:
f"XAUTHORITY={xauth}",
f"DBUS_SESSION_BUS_ADDRESS={dbus_addr}",
f"XDG_RUNTIME_DIR={runtime_dir}",
# Steam Runtime's srt-logger opts INTO the journal when it finds one
# (it inherits this unit's JOURNAL_STREAM), regardless of the DEVNULL
# stderr the spawn already uses. That wrote 481k "joystick FFB" lines
# in one boot and evicted two weeks of history from a 300M journal.
# Steam still keeps its own logs/console-linux.txt; this only stops
# the copy into journald.
"SRT_LOGGER_USE_JOURNAL=0",
]

View File

@ -55,6 +55,16 @@ class TestDesktopEnvArgs:
args = desktop_env_args("bob", 1000)
assert _env_value(args, "XDG_RUNTIME_DIR") == "/run/user/1000"
def test_steam_runtime_logger_kept_out_of_the_journal(self) -> None:
"""srt-logger must be told not to mirror Steam's console into journald.
It inherits the service's JOURNAL_STREAM and opts in on its own; one
boot's worth of joystick FFB errors (481k lines) evicted two weeks of
journal history and the evidence for a curfew failure with it.
"""
args = desktop_env_args("bob", 1000)
assert _env_value(args, "SRT_LOGGER_USE_JOURNAL") == "0"
def test_dbus_address_defaults_to_uid_path(self) -> None:
"""DBUS falls back to the uid-derived socket when unset."""
env_copy = os.environ.copy()