In a stream of Random Thoughts ..

Musings and rummaging …

Rotating Systemd Journals

Doing maintenance at systems at work, I did come across a customer installation where the system journal was taking up a lot of space.

In order to figure out, how much space is taken by the journal:

sudo journalctl --disk-usage
Archived and active journals take up 4.0G in the file system.

Which matches the output from df:

du -sh /var/log/journal/
4.1G	/var/log/journal/

So there is potential to free up some diskspace.

All logs from hosts offloaded to our log management solution, so it just need to be cleared.

So the steps are:

  1. Rotate the journal

  2. Archive

Rotating the journal is done using the following command:

journalctl --rotate

Rotating closes files and creates new empty ones.

Clearing up old journal entries are done like so:

journalctl --vacuum-time=10d

So the time (10d) denotes how far back the journal should be retained.

Or by size:

journalctl --vacuum-size=100M

It can be handled automatically by systemd-journald, by tweaking the following settings.

The systemd-journald can also be configured, by modifying/creating /etc/systemd/journald.conf.d/00-journal.conf. The following flags can be usefull.

Flag Description
SystemMaxUse The maximum disk space journal can consume
SystemMaxFileSize The maximum disk space an individual file can use
SystemMaxFiles Maximum number of journal files