systemd journal logs take a lot of space after a while. Let’s wipe them out!
First you might be interested how much space journal actually takes:
$ sudo journalctl --disk-usage
Archived and active journals take up 72.0M in the file system.
Now you know whether that’s too much or not. In case it is, use --vacuum-size option to limit the size of the log (everything above will be deleted). Here is me running the vacuum with 10MB limit:
$ sudo journalctl --vacuum-size=10M
Vacuuming done, freed 0B of archived journals from /var/log/journal/d0c1c31ca63b4654a92792c004b69295.
As you can see no space was freed up in my case. Why is that? Reading up the man page reveals that running –vacuum-size= has only an indirect effect on the output shown by –disk-usage, as the latter includes active journal files, while the vacuuming operation only operates on archived journal files.
We also learn about --vacuum-time option that limits the vacuum by time (can be combined with the previous option):
$ sudo journalctl --vacuum-size=10M --vacuum-time=2d
Deleted archived journal /var/log/journal/d0c1c31ca63b4654a92792c004b69295/user-1000@0005746cd1587966-78bd9d00691c4f53.journal~ (8.0M).
Vacuuming done, freed 8.0M of archived journals from /var/log/journal/d0c1c31ca63b4654a92792c004b69295.
Above I am deleting entries older than 2 days.
But what about those active files you ask? We need to rotate the log first with journalctl --rotate:
$ sudo journalctl --rotate
# journalctl --vacuum-size=10M --vacuum-time=1s
Using --rotate in combination with 1s (retaining only 1 second old logs) brings the disk usage down almost to zero hovewer it probably won’t be zero exactly. In case we want to be confident removing all log files we need to remove them manualy from /var/log/journal. They always end with .journal. (I do not recommend to remove them this way, but it’s the only way --disk-usage show exactly 0B…)
After the cleanup we might want to prevent excessive log size for the future. For that we can lookup SystemMaxUse option in the /etc/systemd/journald.conf configuration file.
$ sudo cat /etc/systemd/journald.conf
...
SystemMaxUse=50M
...
50M will limit the size of logs to 50MB maximum.
After editing journald.conf file restart systemd-journald service:
$ sudo systemctl restart systemd-journald.service
