mjhjmtu

I've recently updated my Stretch system and this got me version 232-25+deb9u6 of systemd.

A very nasty side effect is that my /var/log/auth.log gets flooded with stuff like:

Nov 30 07:13:34 rpi2-2 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Nov 30 07:13:34 rpi2-2 su[29165]: Successful su for root by root
Nov 30 07:13:34 rpi2-2 su[29165]: + ??? root:root
Nov 30 07:13:34 rpi2-2 su[29165]: pam_unix(su:session): session opened for user root by (uid=0)
Nov 30 07:13:34 rpi2-2 su[29165]: pam_systemd(su:session): Cannot create session: Already running in a session
Nov 30 07:13:34 rpi2-2 su[29165]: pam_unix(su:session): session closed for user root
Nov 30 07:13:34 rpi2-2 sudo: pam_unix(sudo:session): session closed for user root
Nov 30 07:13:35 rpi2-2 sudo: pi : TTY=unknown ; PWD=/home/pi ; USER=root ; COMMAND=/bin/su - -c echo 1 > /sys/class/backlight/rpi_backlight/bl_power

This seems to have been fixed by a more recent version of systemd (see https://github.com/systemd/systemd/pull/10832) but I haven't been able to build that version on my own.

This is a showstopper since I have some code that runs 'su' twice per second, causing auth.log to quickly fill up the root partition.

How can get the latest systemd binary for Raspbian Stretch, or an older version that doesn't have this problem?

You have several questions here, actually and I will try and address each. Note that the solution here seems to be to not use su as pointed out by Stephen Kitt in the comments.

I will address some other aspects.

How do you prepare a debian-based system for building from source, example: systemd (I would recommend to do this in a sandbox system such as a VM few times first)

$ sudo apt-get build-dep systemd

Now, assuming the version you wish to build is not a lot newer than the one you have, the dependencies are often the same, this holds true for patch-releases of systemd. The above command will get all the packages you need to build systemd, except, of course, systemd itself. Note that below, we are going to grab the latest and greatest systemd, note sure all prerequisites are met.

You then get the sources and build; systemd is on github, so you need git to get the sources.

$ sudo apt-get install git
$ git clone https://github.com/systemd/systemd.git

How you exactly build the source depends on the build system used by the developers of the software in question, systemd uses meson. I saw that when I wen to https://github.com/systemd/systemd, I scrolled down, there they have info on the project.

I saw this line:

Information about build requirements is provided in the README file.

and read the README file, always a good idea!

$ sudo apt-get install meson
$ git clone https://github.com/systemd/systemd.git
$ meson systemd/ && ninja -C systemd
$ cd systemd; sudo ninja install

How to configure retention of logs, so they do not fill up your drive:

Here, you need to configure logrotation for rsyslog. The configuration for logrotate lives in /etc/logrotate.d, the file we want is /etc/logrotate.d/rsyslog

Access the docs first:

 $ man logrotate.conf
 $ man logrotate

Ok, so now we have read the docs, we know that the keyword to rotate logs is rotate, size specifies when to rotate to the next file, compress compresses the rotated file, mail mails it (optional), I want the file to be rotated, so I set mailfirst.

My /etc/logrotate.d/rsyslog looks like:

[...]
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
[...]

To configure logrotate for /var/log/auth:

[...]
/var/log/kern.log
/var/log/auth.log

 rotate 10
 size 100M
 compress
 mail jdoe@example.com
 mailfirst

/var/log/user.log
[...]

This will keep max 10 files of 100Mb so almost 1Gb, as soon as a file reaches 100M, it is compressed and emailed to jdoe@example.com. By default, rotatelog is run daily via cron, you might want to run it hourly. man crontab.