Cleaning up systemd journal logs on Fedora

systemd journal logs take a lot of space after a while. Let’s wipe them out!

First you might be interested how much space journal actually takes:

Now you know whether that’s too much or not. In case it is, use --vacuum-size option to limit the size of the log (everything above will be deleted). Here is me running the vacuum with 10MB limit:

As you can see no space was freed up in my case. Why is that? Reading up the man page reveals that running –vacuum-size= has only an indirect effect on the output shown by –disk-usage, as the latter includes active journal files, while the vacuuming operation only operates on archived journal files.

We also learn about --vacuum-time option that limits the vacuum by time (can be combined with the previous option):

Above I am deleting entries older than 2 days.

But what about those active files you ask? We need to rotate the log first with journalctl --rotate:

Using --rotate in combination with 1s (retaining only 1 second old logs) brings the disk usage down almost to zero hovewer it probably won’t be zero exactly. In case we want to be confident removing all log files we need to remove them manualy from /var/log/journal. They always end with .journal. (I do not recommend to remove them this way, but it’s the only way --disk-usage show exactly 0B…)

After the cleanup we might want to prevent excessive log size for the future. For that we can lookup SystemMaxUse option in the /etc/systemd/journald.conf configuration file.

50M will limit the size of logs to 50MB maximum.

After editing journald.conf file restart systemd-journald service:

Join the Conversation

3 Comments

  1. I actually was not familiar with the command and now I need to go see if it’s a Fedora thing, or if it translates across distros. I primarily use Debian personally, and CentOS at work. We do have log space issues on a regular basis, so I’m bookmarking this and following this blog.

    Keep up the good work!

  2. This should be the default.
    With large enough journals, your boot-times can be DRAMATICALLY increased.

    See, on every boot, the systemd parses the logs on the harddisk and so at large enough sizes, this can add several seconds — even minutes to your boot times.
    Very sloppy design.

  3. I’m running Ubuntu 16.04 LTS, and on a 60GB disk, nearly 4GB are consumed by the journal. I failed to realize that some proactive measure is required on my part to prevent journals from consuming a substantial portion of the available disk space. Given that this is on a DigitalOcean virtual machine, I’m paying for every byte, and it seems that the default is inadequate if 4 of 60GB is being consumed. The only time I had ever witnessed such egregious disk space consumption in a non-obvious way was with Windows Search Indexing. This is worse, actually. Thanks for the hugely useful article!

Leave a comment

Leave a Reply to Ben Johnson Cancel reply

Your email address will not be published. Required fields are marked *