How to Clear Systemd Journal Logs
This quick tutorial shows you two ways to clear systemd journal logs from your Linux system.
This quick tutorial shows you two ways to clear systemd journal logs from your Linux system.
The systemd journal is systemd’s own logging system. It is equivalent to the syslog in the init system. It collects and stored kernel logging data, system log messages, standard output, and errors for various systemd services.
A Linux machine with systemd writes the logs to /var/log/journal directory. If you remember the Linux directory structure, /var is where the system logs are stored.
You can either manually view the log files using less command or use the journalctl command. To view all the latest logs, use the command with the reverse option.
The thing with logging is that over time, it starts to grow big. And if you check the disk space in Linux, you’ll see that sometimes, it takes several GB of space.
Let me show you how to clean systemd journal logs and free up disk space on your Linux system.
Clearing systemd journal logs
First, check the space taken by journal logs with the du command:
You can also use the journalctl command for the same task:
Both commands should give approximately the same result:
Now that you know how much space the journal logs take, you can decide if you want to clear the logs or not. If you decide to clear the journal logs, let me show you a couple of ways of doing it.
You can, of course, use the rm command to delete the files in the log folder but I won’t advise that. The journalctl command gives you the proper way of handling old logs.
First thing you should do is to rotate journal files. This will mark the currently active journal logs as archive and create fresh new logs. It’s optional but a good practice to do so.
Now you have three ways to clear old journal logs. You delete logs older than a certain time, or you delete older log files so that the total log size is limited to the predefined disk space, or you limit the number of log files. Let’s see how to use all three methods.
1. Clear journal log older than x days
Keep in mind that logs are important for auditing purposes so you should not delete all of them at the same time. Let’s say you want to keep the log history of just two days. To delete all entries older than two days, use this command:
Here’s what the output may look like:
You can also change the provide time frame in hours like 2h, in minutes like 2m, in seconds like 2s. If you want bigger time units, you can 2weeks, 2months as well.
2. Restrict logs to a certain size
Another way is to restrict the log size. This will delete the journal log files until the disk space taken by journal logs falls below the size you specified.
This will reduce the log size to around 100 MB.
You can specify the size in GB with G, MB with M, KB with K etc.
3. Restrict number of log files
The third way is to limit the number of log files. The journalctl usually has log files for the system and for the users. As the logs get old, they are archived in various files.
You can limit the number of archive log files. Let’s say you want to have only five log files.
It will remove the older archive log files leaving only the specified number of log files.
Linux Handbook Abhishek Prakash
Automatically clearing old log files [Requires intermediate knowledge of command line]
What you just did will clean the log files for now. In a month, the logs will increase again. You can manually clean them with one of the methods described above. But that is a tedious task and you may not remember to do that regularly.
The good thing is that you can configure systemd to automatically handle old log files.
The journalctl has configuration file at /etc/systemd/journald.conf. There are settings which are commented out. The commented lines basically indicate the default value of those settings parameters (even if they are commented out).
You can change some of these default settings to automatically clean the log files.
You would want to change the following settings:
| Setting | Description |
|---|---|
| SystemMaxUse | Max disk space logs can take |
| SystemMaxFileSize | Max size of an INDIVIDUAL log file |
| SystemMaxFiles | Max number of log files |
Please note that you should be careful while editing configuration files. You must be comfortable using a terminal-based text editor like Vim, Emacs or Nano so that you don’t make silly mistakes while editing the conf file.
I advise to make a backup of the configuration file first:
Now, you should uncomment (remove the # at the beginning of the line) the setting you want to use. For example, I want to restrict the maximum disk space taken by the log files to 250 MB.
You’ll have to use Vim or some other terminal based editor in order to edit this configuration file. Here’s what it looks like me after editing the file.
Keep in mind that after editing the configuration file, you should load the changes:
The journald.conf file can be used to tweak the journalctl settings even further. You can even set the levels of log (info, debug, error etc) you want to see. It’s up to you if you want to change those settings as well.
Linux Handbook Abhishek Prakash
I hope you like this tip to clear systemd journal log files. If you have any questions or suggestions, please leave a comment below.
How to cleanup a /var/log/journal in Linux
You may find your /var/log/journal directory taking up a lot of disk-space.
How do you go about removing, or deleting all these files under var log journal without the system complaining and falling over?
How to tell how much space is being taken?#
You can ask the journalctl command directly, using the —disk-usage argument:
It will report something like this:
Journals take up 3.9G on disk.
Fix: Option 1 (not ideal):#
Go and adjust its config under /etc/systemd/journald.conf , making sure to pay attention to the SystemMaxUse key; set this to something reasonable, like 50M perhaps.
At this point you can force a log rotation by issuing this command:
Remember to restart the systemctl process, like this:
Fix: Option 2 (not recommended):#
You could always go and delete the offending /var/log/journal/** directory contents, but this is not the recommended way, as the system journal could be writing here, which will probably cause you bigger problems!
Fix: Option 3 (RECOMMENDED!):#
Simply run the following command to cleanup the /var/log/journal directory:
This will delete old log files until the directory reaches the threshold size stipulated, in our case, 500M.
Can I remove files in /var/log/journal and /var/cache/abrt-di/usr?
I use Fedora and these directories contains a large amount of files, I wonder whether I can delete them? The system is running low on space.
3 Answers 3
journal logs
Yes you can delete everything inside of /var/log/journal/* but do not delete the directory itself. You can also query journalctl to find out how much disk space it’s consuming:
You can control the size of this directory using this parameter in your /etc/systemd/journald.conf :
You can force a log rotation:
NOTE: You might need to restart the logging service to force a log rotation, if the above signaling method does not do it. You can restart the service like so:
abrt logs
These files too under /var/cache/abrt-di/* can be deleted as well. The size of the log files here is controlled under:
You can control the max size of /var/cache/abrt-di by changing the following in file, /etc/abrt/plugins/CCpp.conf :
NOTE: If not defined DebugInfoCacheMB defaults to 4000 (4GB).
How to Fix a Big /var/log/journal?
In Linux, the journal is part of the system which comprises all the information regarding kernel or boot messages, Syslog messages, etc., stored in the journal file. The centralized location is available in the “/var/log/” directory. The logs in that file make it huge sometimes, which needs to be cleaned up to have a smooth system performance (just like the cache).
In this post, we will demonstrate the possible solutions to deal with the huge size of the /var/log/journal. Let’s get into it:
- How to Clean Up /var/log/journal File?
- Method 1: Using the –vacuum-size Option of the journalctl Command
- Method 2: Using the –vacuum-time Option of the journalctl Command
- Method 3: Using the –vacuum-files Option of the journalctl Command
Let’s get started.
How to Clean Up /var/log/journal File?
The reason for the increase in the file size is that logs are not cleaned up. To check the overall space occupied by the “var/log/journal” file, use the below-stated command:
The output shows that the disk space occupied by the journal files is “472.1MB”. Now, let’s examine the methods to overcome the large journal log files.
Method 1: Using the –vacuum-size Option of the journalctl Command
The “–vacuum-size”is the option that is used for limiting the disk usage of journal files and will limit the size of the “/var/log/journal” file. For instance, the command provided below will limit the size of journal files to 100MB:
Limiting the size of the journal logs will stop more using space, but it will not delete the existing files.
Note: Only archived Files will be deleted to reduce the journal log size.
Restart the journal service to update the changes:
Method 2: Using the –vacuum-time Option of the journalctl Command
The “–vacuum-time” is the option used for deleting the old journal files with time such as hours, days, and years. You can use this to clear your journal files. To do so, execute the below command in the terminal:
In our scenario, we have deleted the old journal logs for the last 5 days.
Then restart the journal service to activate the changes using the below command:
Method 3: Using the –vacuum-files Option of the journalctl Command
The “–vacuum-files” is the option that is also used for deleting the old files in a journal. This option will clear the journal by limiting the number of files:
The above command will reduce the number of files to 2 by deleting the old files.
Note: The “–vacuum-files” option will not delete the files that are currently active or in use.
Restart the journal service to apply the new changes:
After that user can verify the journal for internal consistency:
That’s it from this guide.
Conclusion
To resolve the big size issue of “/var/log/journal” in Linux, reduce the size of the journal log files by using the “ sudo journalctl –vacuum-size=<size-in-MB>” and “sudo journalctl –vacuum-time=<hours/weeks/months/years>” command. After that, restart the journal service using the “sudo service systemd-journald restart” command and verify the journal for internal consistency by running the “journalctl –verify” command. This post has demonstrated the possible solutions to eliminate the large size of “/var/log/journal” in Linux.