How to clear the system log log

systemd has its own logging system, which provides centralized management of the logging kernel and user-mode processes. This article describes how to clear the systemd journal log file.systemd-journald Is a system service that collects and stores logging data. This log data is stored in /run/log/journal/MACHINE-ID/ (Volatile-log log data is stored in memory and lost on restart) or /var/log/journal/MACHINE-ID (Permanent-Journal data logs are stored on disk). On systems configured to store syslog data on disk, after a period of time, the logs may take up a lot of disk space.

But before trying to clear the systemd journal log files, let’s use the following command to see how much space these log files actually occupy on the system:

journalctl --disk-usage

Example output:

$ journalctl --disk-usage
Archived and active journals take up 1.6G in the file system.

It is worth noting journalctl --disk-usage The total disk usage of archived and active log files is displayed, so even if the log log files described below are cleared, it will not show 0 disk space usage. To delete all log entries (including marked activity log files) --rotate Command), use:

sudo journalctl --rotate
sudo journalctl --vacuum-time=1s

Here:

  • --rotate Ask the log daemon to rotate log files. The purpose of log file rotation is to mark all currently active log files as archived and renamed so that they are no longer written in the future. Then create a new (empty) journal file in its place. Otherwise, the activity log file will not be deleted. --vacuum*= command.
  • --vacuum-time=1s Make all log files not contain more than 1 second of data. You can change --vacuum-time The time you need, such as 1m 1 minute 2h 1 hour 2weeks 2 weeks, 4months 4 months.

you can use it --vacuum-size Instead --vacuum-time (You can also use both) to delete the oldest archived journal files until the disk space they use falls below the specified size. Specify --vacuum-size Values ​​are followed by the usual “K”, “M”, “G”, and “T” suffixes, such as journalctl --vacuum-size=100M Delete archived journal files until the disk space they use falls below 100M.
I also want to point out that in newer systemd versions (240 and higher, such as used in Ubuntu 19.04 and higher), you can use a combination --vacuum*= with --rotate command. For example, to rotate log files and delete archived log files until they use less than 500M of disk space, you can use:

sudo journalctl --rotate --vacuum-size=500M

These commands are used on demand when you want to manually clear the journal log. However, you can also configure logging so that archived logs are purged after a certain size on disk or after a given time. This can be done by editing the log configuration file (/etc/systemd/journald.conf), Then uncomment and add a value to SystemMaxUse = (for example: SystemMaxUse=100M Delete archived journal files until the disk space they use falls below 100M) and / or MaxFileSec= (.E.g. MaxFileSec=5day So that all journal files do not contain more than 5 days of data).
You might also like:

  • How to delete old snapshot versions to free up disk space
  • How to remove unused Flatpak runtime to free up disk space

Source

Sidebar