How to Clear systemd Journal Logs

1. Overview

Logs provide important information for diagnostic purposes. Notably, they’re especially important when analyzing system errors arising from failed services. However, we usually need to remove unnecessary logs in a timely manner. Otherwise, they could occupy a significant part of storage.

In this tutorial, we’ll see how to clear the system logs in Ubuntu 20.04. However, the steps described here should be the same on most Linux systems using systemd.

2. Logging Mechanism

In Linux, applications often place their logs under /var/log. For example, the logs from the NGINX web server go under /var/log/nginx.

However, on systems utilizing systemd, the logs can also go under /var/log/journal. Thus, systemd provides a centralized logging system. Essentially, it employs the journal to gather and handle logs.

Further, the journal system uses the journald daemon to manage logs. To access these log messages, we use the journalctl command.

3. Check Log Size

Due to their global nature, the systemd journal logs can accumulate quickly. Thus, system resources could be impacted severely. Therefore, we should regularly assess the size of these logs.

Notably, we can check the size of the journal logs with the journalctl command. To do so, we use the –disk-usage option:

$ journalctl --disk-usage 
Archived and active journals take up 32.0M in the file system.

This command shows the storage space used by the archived and active journal logs.

4. Clear Journal Logs

Older logs may not be useful for day-to-day work. Let’s see how to reduce log size using the journalctl command.

4.1. Removing Logs Older Than a Specified Period

We can use the –vaccum-time option to clear logs older than a specified number of days:

$ sudo journalctl --vacuum-time=7d
Vacuuming done, freed 0B of ... from /run/log/journal.
Deleted archived journal /var/log/journal/...
...

The above command uses sudo to get administrative rights. Consequently, it clears logs older than seven days. We can modify the 7d parameter as needed. This way, we have a maintenance job that automatically handles log deletion.

However, sometimes logs of a given period are too big. Let’s see how to handle this case.

4.2. Clearing Logs Based on Size

The –vaccum-size option sets a threshold to clear logs based on a specific size.

For example, we can clear logs until we reduce the total size to 1GB:

$ journalctl --vacuum-size=1G 
Vacuuming done, freed 0B of archived journals...
Vacuuming done, freed 0B ...
...

This ensures the logs stay within a defined size constraint.

5. Automating journalctl Log Cleanup

Manual log cleanup can be time-consuming. Thus, automating the log-cleaning process ensures a reduction of log size without manual intervention.

As expected, we can use the cron scheduler to automate the log cleanup process.

Let’s edit our crontab file with the crontab command and the -e option:

$ sudo crontab -e

Next, we can add the following expression for a daily cleanup at midnight:

0 0 * * * journalctl --vacuum-time=1d

This automates daily cleanup, maintaining system efficiency effortlessly.

6. Setting Limit on Journal Size

The /etc/systemd/journald.conf file controls the space the journal can use for storing logs. In particular, there are several options in this file to limit the journal size.

These options control how much space the journal can use in two types of storage:

• persistent storage: data is saved even after a system restart
• volatile storage: data is temporary and resets after a restart

Let’s see the options for maximum disk space in persistent storage:

1. SystemMaxUse: specifies the maximum disk space that the journal can use
2. SystemKeepFree: sets how much space the journal should keep free when adding entries
3. SystemMaxFileSize: controls the size to which individual journal files can grow before rotation

Similarly, there are options for maximum disk space in volatile storage (/run filesystem):

1. RuntimeMaxUse: specifies the maximum disk space that can be used
2. RuntimeKeepFree: sets aside space for other uses when writing data
3. RuntimeMaxFileSize: controls the size an individual journal file can reach before rotation

We can uncomment the related entities in the journald.conf file to use any of the above options.

7. Conclusion

In this article, we saw how to clear systemd journal logs.

First, we learned how to get the size of the journal logs. Then, we discussed clearing logs based on size and time. Furthermore, we used the cron scheduler to automate the log-cleaning process.

Finally, we looked at the journald.conf file to set a limit on journal log size.