Rotating Systemd Journals

Doing maintenance at systems at work, I did come across a customer installation where the system journal was taking up a lot of space.

In order to figure out, how much space is taken by the journal:

sudo journalctl --disk-usage

Archived and active journals take up 4.0G in the file system.

Which matches the output from df:

du -sh /var/log/journal/

4.1G	/var/log/journal/

So there is potential to free up some diskspace.

All logs from hosts offloaded to our log management solution, so it just need to be cleared.

So the steps are:

1. Rotate the journal

2. Archive

Rotating the journal is done using the following command:

journalctl --rotate

Rotating closes files and creates new empty ones.

Clearing up old journal entries are done like so:

journalctl --vacuum-time=10d

So the time (10d) denotes how far back the journal should be retained.

Or by size:

journalctl --vacuum-size=100M

It can be handled automatically by systemd-journald, by tweaking the following settings.

The systemd-journald can also be configured, by modifying/creating /etc/systemd/journald.conf.d/00-journal.conf. The following flags can be usefull.