Journal/log is using 1GB. how can I purge?

Linux Support
1

My /var/log/journal/ folder is over 2GB on my media server.

How can I clean this folder/logs? I’m running out of space in root.

Everying is stored under one folder in:
/var/log/journal/d04c5eba696d78de8d04e391f410bab0/

2

Have a peek at this: sounds like you can delete the log. But I never have.

Or

1 Like
3

If your distro includes log rotate then you can just do something like rm -r /var/log/journal/*NN.log where NNis the regular expression of the numbers. Log rotate changes the name of the log to 01, 02 etc when it rotates them out, plus you can decide how many days you want to keep them for it’s default is 5 days. So in theory you could set it to keep the logs for 2 days and it would purge the rest .

2 Likes
4

I did this recently on this StackLinux server that hosts this forum.

Here’s output from history.

temp10396@forums:~$ history | grep journal
sudo journalctl --vacuum-time=7d
sudo journalctl --vacuum-size=512M

So basically when you login, the two lines above can be tweaked to prune the size of logs stored/retained. As set above logs will be pruned based on which limit is hit first. (days or size)

2 Likes
5

Thanks guys! Vacuuming worked.

6

And I just learned a spiffy new trick :grin:
From the man page; man journalctl, it states:
`–disk-usage
Shows the current disk usage of all journal files. This shows the
sum of the disk usage of all archived and active journal files.

   --vacuum-size=, --vacuum-time=, --vacuum-files=
       Removes the oldest archived journal files until the disk space they
       use falls below the specified size (specified with the usual "K",
       "M", "G" and "T" suffixes), or all archived journal files contain
       no data older than the specified timespan (specified with the usual
       "s", "m", "h", "days", "months", "weeks" and "years" suffixes), or
       no more than the specified number of separate journal files remain.
       Note that running --vacuum-size= has only an indirect effect on the
       output shown by --disk-usage, as the latter includes active journal
       files, while the vacuuming operation only operates on archived
       journal files. Similarly, --vacuum-files= might not actually reduce
       the number of journal files to below the specified number, as it
       will not remove active journal files.

       --vacuum-size=, --vacuum-time= and --vacuum-files= may be combined
       in a single invocation to enforce any combination of a size, a time
       and a number of files limit on the archived journal files.
       Specifying any of these three parameters as zero is equivalent to
       not enforcing the specific limit, and is thus redundant.

       These three switches may also be combined with --rotate into one
       command. If so, all active files are rotated first, and the
       requested vacuuming operation is executed right after. The rotation
       has the effect that all currently active files are archived (and
       potentially new, empty journal files opened as replacement), and
       hence the vacuuming operation has the greatest effect as it can
       take all log data written so far into account.`

I checked the size of my logs and had 4.2 G of logs - it’s down to 624.4M now.
Thanks Hayden!

2 Likes
7

A couple of years later, I wanted to follow up with a few extra tips in case anyone else runs into this.

If you’re regularly hitting large journal logs, it might help to check your current log usage with:

journalctl --disk-usage

You can also set a permanent limit so you don’t have to prune logs manually. Edit /etc/systemd/journald.conf and add or modify:

SystemMaxUse=500M
SystemMaxFileSize=100M

Then restart the service:

sudo systemctl restart systemd-journald

Hope this helps!

Reference: journald.conf

  • SystemMaxUse= controls how much total disk space the journal may use up at most.
  • SystemMaxFileSize= controls how large the individual journal files may grow at most.
1 Like