Managing Journal Size

By default, systemd-journald ensures older journal records or journal files are deleted in order to keep a certain amount of disk space free. In the Linux Logging with Systemd section, we explain how to control the thresholds for deleting old log data with configuration parameters. We can also use journalctl to manage the size of the journal, which we’ll explain in more detail in this section.

To check how much disk space is currently taken up by the journal, use the –disk-usage parameter:

$ journalctl --disk-usage

Depending on the version of journalctl, the output can be similar to this:

Archived and active journals take up 96.0M on disk.

or:

Journals take up 248.0M on disk.

You can also manage disk space taken up by systemd journal by fine-tuning these configuration parameters:

• COMPRESS
• SYSTEMKEEPFREE
• RUNTIMEKEEPFREE
• SYSTEMMAXFILESIZE
• RUNTIMEMAXFILESIZE
• MAXRETENTIONSEC
• MAXFILESEC

Deleting or Vacuuming Journals

To delete archived journal entries manually, you can use either the –vacuum-size or the –vacuum-time option. In the example below, we are deleting any archived journal files, so the journal size comes back to 200MB.

$ journalctl --vacuum-size=200M

The output should be something similar to this.

Vacuuming done, freed 200M of archived journals from /var/log/journal/ebb94c86dc6447fba1f308728c4

2de55

on disk.

When using –vacuum-time option, archived journals older than the time specified will be deleted.

These two options are available from systemd version 218.

You can also use the --vacuum-files option, which deletes all but the specified number of journal files. For example, if you have 10 archived journal files and want to reduce these down to 2, you can do so by running the following command:

$ journalctl --vacuum-files=2

Note that this won’t delete any journal files that are actively in use.

Verifying Journals

To verify the journal for internal consistency, use the –verify option:

$ journalctl --verify

There will be a graphical progress bar as the check is done. Sometimes an alert message will be shown:

42a840: data object references invalid entry at 600f720

File corruption detected at /var/log/journal/6312944ca8d9f189228c76ab557a9109/system.journal:000000 (of 109051904 bytes, 0%).

FAIL: /var/log/journal/6312944ca8d9f189228c76ab557a9109/system.journal (Bad message)

If the test passes, the output will look similar to the following:

PASS: /var/log/journal/ebb94c86dc6447fba1f308728c42de55/user-1000.journal

PASS: /var/log/journal/ebb94c86dc6447fba1f308728c42de55/system.journal

PASS: /var/log/journal/ebb94c86dc6447fba1f308728c42de55/system@00058c1aae2cfb13-b514d537186475f7.journal~

PASS: /var/log/journal/ebb94c86dc6447fba1f308728c42de55/user-1000@00058c1aae5a2638-470aa0f248caea09.journal~