Managing Journal Systemd Ubuntu

0
466

By default, systemd-journald ensures older journal records or journal files are deleted in order to keep a certain amount of disk space free. In the Linux Logging with Systemd section, we explain how to control the thresholds for deleting old log data with configuration parameters. We can also use journalctl to manage the size of the journal, which we’ll explain in more detail in this section.

To check how much disk space is currently taken up by the journal, use the –disk-usage parameter:

$ journalctl --disk-usage

Depending on the version of journalctl, the output can be similar to this:

Archived and active journals take up 1.5G in the file system.

or:

Journals take up 1.5G on disk.

You can also manage disk space taken up by systemd journal by fine-tuning these configuration parameters:

  • COMPRESS
  • SYSTEMKEEPFREE
  • RUNTIMEKEEPFREE
  • SYSTEMMAXFILESIZE
  • RUNTIMEMAXFILESIZE
  • MAXRETENTIONSEC
  • MAXFILESEC

Deleting or Vacuuming Journals

To delete archived journal entries manually, you can use either the –vacuum-size or the –vacuum-time option. In the example below, we are deleting any archived journal files, so the journal size comes back to 200MB.

$ journalctl --vacuum-size=200M

The output should be something similar to this.

Vacuuming done, freed 200M of archived journals from /var/log/journal/ebb94c86dc6447fba1f308728c4

2de55

on disk.

When using –vacuum-time option, archived journals older than the time specified will be deleted.

These two options are available from systemd version 218.

You can also use the –vacuum-files option, which deletes all but the specified number of journal files. For example, if you have 10 archived journal files and want to reduce these down to 2, you can do so by running the following command:

$ journalctl --vacuum-files=2

Note that this won’t delete any journal files that are actively in use.

Clear systemd journals older than X days

The first one is time-based, clearing everything older than say 10 days.

$ journalctl --vacuum-time=10d
...
Vacuuming done, freed 2.3G of archived journals on disk.

Verifying Journals

To verify the journal for internal consistency, use the –verify option:

$ journalctl --verify

There will be a graphical progress bar as the check is done. Sometimes an alert message will be shown:

LEAVE A REPLY

Please enter your comment!
Please enter your name here