Introduction
Systemd journal logs are stored under /var/log/journal and can gradually consume a significant amount of disk space on Linux servers. When /var becomes full, excessive journal logs can contribute to disk-space issues and may affect system services.
This article explains how to safely reduce the size of systemd journal logs using journalctl and configure a maximum disk-space limit for persistent journal logs.
Prerequisites
Before clearing systemd journal logs, ensure the following requirements are met:
- Root or sudo access to the Linux server.
- The server should be running a systemd-based Linux distribution such as CentOS, AlmaLinux, Rocky Linux, RHEL, Ubuntu, or Debian.
- Verify that the systemd-journald service is available and running.
- Ensure there is sufficient access to edit the
/etc/systemd/journald.confconfiguration file. - Check the current disk usage and confirm that journal logs are consuming excessive space under
/varor/var/log/journal. - Ensure that any logs required for troubleshooting, auditing, or compliance purposes are backed up before removing older entries.
Implementation
We ran out of disk space on our server, and /var consumes more disk space. On checking further, /var/log/journal consumes more disk space.
The safest way to remove unnecessary entries via journalctl
journalctl --vacuum-size=128M
Now, verify journalctl.
journalctl --verify
Edit SystemMaxUse in/etc/systemd/journald.conf
vi /etc/systemd/journald.confSystemMaxUse=128M
Conclusion
Regularly managing systemd journal logs helps prevent /var from consuming excessive disk space. The journalctl --vacuum-size=128M command can remove older journal entries while retaining logs within the specified size limit.
Configuring SystemMaxUse=128M in /etc/systemd/journald.conf also helps control the amount of disk space that journald can use. After making configuration changes, reload or restart systemd-journald and periodically verify disk usage to ensure the setting is effective.
FAQs
1. What is the systemd journal log?
The systemd journal is a centralized logging system used by Linux to collect and store system and service logs. These logs are commonly stored under /var/log/journal.
2. Why does /var/log/journal consume a lot of disk space?
Journal logs can grow over time as the system continuously records messages from the kernel, services, applications, and other system components.
3. Does journalctl --vacuum-size=128M delete all journal logs?
No. It removes older archived journal files as necessary to reduce the total journal size to the specified limit. The currently active journal file is not removed.
Related Articles
Bash Script to Capture Login Activity Logs
Talk to our experts
Looking for the right technology solution for your business?. Our experts can help with web hosting, domain registration, DevOps and cloud, software development, web applications, mobile applications, and enterprise solutions. Get in touch with our team here.