Linux log journal clear

How to cleanup a /var/log/journal in Linux

You may find your /var/log/journal directory taking up a lot of disk-space.

How do you go about removing, or deleting all these files under var log journal without the system complaining and falling over?

How to tell how much space is being taken?#

You can ask the journalctl command directly, using the —disk-usage argument:

It will report something like this:

Journals take up 3.9G on disk.

Fix: Option 1 (not ideal):#

Go and adjust its config under /etc/systemd/journald.conf , making sure to pay attention to the SystemMaxUse key; set this to something reasonable, like 50M perhaps.

At this point you can force a log rotation by issuing this command:

sudo systemctl kill --kill-who=main --signal=SIGUSR2 systemd-journald.service 

Remember to restart the systemctl process, like this:

sudo systemctl restart systemd-journald.service 

Fix: Option 2 (not recommended):#

You could always go and delete the offending /var/log/journal/** directory contents, but this is not the recommended way, as the system journal could be writing here, which will probably cause you bigger problems!

Fix: Option 3 (RECOMMENDED!):#

Simply run the following command to cleanup the /var/log/journal directory:

journalctl --vacuum-size=500M 

This will delete old log files until the directory reaches the threshold size stipulated, in our case, 500M.

It really is that easy to clear or clean up your var log journal!

Источник

Free up Disk Space – Clear Systemd Journal Logs in Ubuntu 20.04

Going to free up Ubuntu system disk space? Try clearing the systemd journal logs, it may free up a few GB of space.

By using the Disk Usage Analyzer tool, I found that /var/log/journal takes more than 4 GB system space in my Ubuntu 20.04.

Systemd has its own logging system called the journal, and the log files are stored in /var/log/journal. As long as I don’t need the logs for any debugging, it’s safe to delete these files. And following steps will show you how.

1. First open terminal from system app launcher, and you may run command to check out the current disk usage of all journal files:

2. If you decide to clear the logs, run command to rotate the journal files. All currently active journal files will be marked as archived, so that they are never written to in future.

3. Now clear the journal logs by choosing one of following commands:

Delete journal logs older than X days:

sudo journalctl --vacuum-time=2days

sudo journalctl --vacuum-size=100M

sudo journalctl --vacuum-files=5

4. You can also edit the configuration file to limit the journal log disk usage (100 MB for example).

Run command in terminal to edit the file via Gedit text editor:

sudo -H gedit /etc/systemd/journald.conf

When the file opens, un-comment (remove # at the beginning) the line #SystemMaxUse= and change it to SystemMaxUse=100M.

Save the file and reload systemd daemon via command:

Источник

How to Clear Systemd Journal Logs

This quick tutorial shows you two ways to clear systemd journal logs from your Linux system.

This quick tutorial shows you two ways to clear systemd journal logs from your Linux system.

The systemd journal is systemd’s own logging system. It is equivalent to the syslog in the init system. It collects and stored kernel logging data, system log messages, standard output, and errors for various systemd services.

A Linux machine with systemd writes the logs to /var/log/journal directory. If you remember the Linux directory structure, /var is where the system logs are stored.

You can either manually view the log files using less command or use the journalctl command. To view all the latest logs, use the command with the reverse option.

The thing with logging is that over time, it starts to grow big. And if you check the disk space in Linux, you’ll see that sometimes, it takes several GB of space.

Let me show you how to clean systemd journal logs and free up disk space on your Linux system.

Clearing systemd journal logs

First, check the space taken by journal logs with the du command:

You can also use the journalctl command for the same task:

Both commands should give approximately the same result:

[email protected]:~$ journalctl --disk-usage Archived and active journals take up 1.6G in the file system. [email protected]:~$ sudo du -sh /var/log/journal/ 1.7G /var/log/journal/

Now that you know how much space the journal logs take, you can decide if you want to clear the logs or not. If you decide to clear the journal logs, let me show you a couple of ways of doing it.

You can, of course, use the rm command to delete the files in the log folder but I won’t advise that. The journalctl command gives you the proper way of handling old logs.

First thing you should do is to rotate journal files. This will mark the currently active journal logs as archive and create fresh new logs. It’s optional but a good practice to do so.

Now you have three ways to clear old journal logs. You delete logs older than a certain time, or you delete older log files so that the total log size is limited to the predefined disk space, or you limit the number of log files. Let’s see how to use all three methods.

1. Clear journal log older than x days

Keep in mind that logs are important for auditing purposes so you should not delete all of them at the same time. Let’s say you want to keep the log history of just two days. To delete all entries older than two days, use this command:

sudo journalctl --vacuum-time=2d

Here’s what the output may look like:

Vacuuming done, freed 1.6G of archived journals from /var/log/journal/1b9ab93094fa4978beba80fd3c48a18c

You can also change the provide time frame in hours like 2h, in minutes like 2m, in seconds like 2s. If you want bigger time units, you can 2weeks, 2months as well.

2. Restrict logs to a certain size

Another way is to restrict the log size. This will delete the journal log files until the disk space taken by journal logs falls below the size you specified.

sudo journalctl --vacuum-size=100M

This will reduce the log size to around 100 MB.

Vacuuming done, freed 40.0M of archived journals from /var/log/journal/1b9ab93094fa4978beba80fd3c48a18c.

You can specify the size in GB with G, MB with M, KB with K etc.

3. Restrict number of log files

The third way is to limit the number of log files. The journalctl usually has log files for the system and for the users. As the logs get old, they are archived in various files.

You can limit the number of archive log files. Let’s say you want to have only five log files.

It will remove the older archive log files leaving only the specified number of log files.

Deleted archived journal /var/log/journal/1b9ab93094fa4978beba80fd3c48a18c/[email protected]5988c0982.journal (8.0M). Deleted archived journal /var/log/journal/1b9ab93094fa4978beba80fd3c48a18c/[email protected]9747a2ebd5a3.journal (48.0M). Deleted archived journal /var/log/journal/1b9ab93094fa4978beba80fd3c48a18c/[email protected]7a32024d0.journal (48.0M). Vacuuming done, freed 104.0M of archived journals from /var/log/journal/1b9ab93094fa4978beba80fd3c48a18c.

Automatically clearing old log files [Requires intermediate knowledge of command line]

What you just did will clean the log files for now. In a month, the logs will increase again. You can manually clean them with one of the methods described above. But that is a tedious task and you may not remember to do that regularly.

The good thing is that you can configure systemd to automatically handle old log files.

The journalctl has configuration file at /etc/systemd/journald.conf. There are settings which are commented out. The commented lines basically indicate the default value of those settings parameters (even if they are commented out).

You can change some of these default settings to automatically clean the log files.

You would want to change the following settings:

Setting	Description
SystemMaxUse	Max disk space logs can take
SystemMaxFileSize	Max size of an INDIVIDUAL log file
SystemMaxFiles	Max number of log files

Please note that you should be careful while editing configuration files. You must be comfortable using a terminal-based text editor like Vim, Emacs or Nano so that you don’t make silly mistakes while editing the conf file.

I advise to make a backup of the configuration file first:

cp /etc/systemd/journald.conf /etc/systemd/journald.conf.back

Now, you should uncomment (remove the # at the beginning of the line) the setting you want to use. For example, I want to restrict the maximum disk space taken by the log files to 250 MB.

You’ll have to use Vim or some other terminal based editor in order to edit this configuration file. Here’s what it looks like me after editing the file.

# This file is part of systemd. # # systemd is free software; you can redistribute it and/or modify it # under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2.1 of the License, or # (at your option) any later version. # # Entries in this file show the compile time defaults. # You can change settings by editing this file. # Defaults can be restored by simply deleting this file. # # See journald.conf(5) for details. [Journal] #Storage=auto #Compress=yes #Seal=yes #SplitMode=uid #SyncIntervalSec=5m #RateLimitIntervalSec=30s #RateLimitBurst=1000 SystemMaxUse=250M #SystemKeepFree= #SystemMaxFileSize= #SystemMaxFiles=100 

Keep in mind that after editing the configuration file, you should load the changes:

sudo systemctl restart systemd-journald

The journald.conf file can be used to tweak the journalctl settings even further. You can even set the levels of log (info, debug, error etc) you want to see. It’s up to you if you want to change those settings as well.

I hope you like this tip to clear systemd journal log files. If you have any questions or suggestions, please leave a comment below.

Источник

How To Clear The systemd journal Logs (journalctl)

systemd-journald is a system service that collects and stores logging data. This log data is stored either in /run/log/journal/MACHINE-ID/ (volatile – the journal log data is stored in memory and is lost on reboot) or in /var/log/journal/MACHINE-ID (persistent – the journal data log is stored on disk). On systems which are configured to store the systemd journal data on disk, the logs can take a considerable amount of disk space after some time.

But before trying to clear the systemd journal log files, let’s take a look at how much space these log files actually take on your system, by using the following command:

$ journalctl --disk-usage Archived and active journals take up 1.6G in the file system.

It’s worth noting that journalctl —disk-usage shows the sum of the disk usage of both archived and active journal files, so it won’t show 0 disk space usage even after clearing the journal log files as mentioned below.

To remove all journal entries (including active journal files, which are marked as archived by the —rotate command), use:

sudo journalctl --rotate sudo journalctl --vacuum-time=1s

• —rotate asks the journal daemon to rotate journal files. Journal file rotation has the effect that all currently active journal files are marked as archived and renamed, so that they are never written to in future. New (empty) journal files are then created in their place. Without this, active journal files are not removed by the —vacuum*= command.
• —vacuum-time=1s makes all journal files contain no data older than 1 second. You may change the —vacuum-time period to suit your needs, e.g. 1m for 1 minute, 2h for 1 hour, 2weeks for 2 weeks, 4months for 4 months.

I also want to note that on newer systemd versions (240 and newer, used for example in Ubuntu 19.04 and newer), you may combine the —vacuum*= and —rotate commands. For example to rotate journal files and remove archived journal files until the disk space they use is under 500M, you could use:

sudo journalctl --rotate --vacuum-size=500M

These commands are for usage on demand, when you want to clear the journal logs manually. But you can also configure journald to clear archived logs after they exceed a certain size on disk, or after a given amount of time. This can be done by editing the journald configuration file ( /etc/systemd/journald.conf ), and uncommenting, then adding a value to SystemMaxUse= (e.g.: SystemMaxUse=100M to remove archived journal files until the disk space they use falls below 100M) and/or MaxFileSec= (.e.g. MaxFileSec=5day to make all journal files contain no data older than 5 days).

Источник