How To Clear The systemd journal Logs (journalctl)
systemd has its own logging system which provides centralized management for logging kernel and userland processes. This article explains how to clear the systemd journal (
But before trying to clear the systemd journal log files, let's take a look at how much space these log files actually take on your system, by using the following command:
Example with output:
It's worth noting that
To remove all journal entries (including active journal files, which are marked as archived by the
Here:
You may use
I also want to note that on newer systemd versions (240 and newer, used for example in Ubuntu 19.04 and newer), you may combine the
These commands are for usage on demand, when you want to clear the journal logs manually. But you can also configure journald to clear archived logs after they exceed a certain size on disk, or after a given amount of time. This can be done by editing the journald configuration file (
You may also like:
journalctl) log files.systemd-journald is a system service that collects and stores logging data. This log data is stored either in /run/log/journal/MACHINE-ID/ (volatile – the journal log data is stored in memory and is lost on reboot) or in /var/log/journal/MACHINE-ID (persistent – the journal data log is stored on disk). On systems which are configured to store the systemd journal data on disk, the logs can take a considerable amount of disk space after some time.But before trying to clear the systemd journal log files, let's take a look at how much space these log files actually take on your system, by using the following command:
journalctl --disk-usageExample with output:
$ journalctl --disk-usage
Archived and active journals take up 1.6G in the file system.It's worth noting that
journalctl --disk-usage shows the sum of the disk usage of both archived and active journal files, so it won't show 0 disk space usage even after clearing the journal log files as mentioned below.To remove all journal entries (including active journal files, which are marked as archived by the
--rotate command), use:sudo journalctl --rotate
sudo journalctl --vacuum-time=1sHere:
--rotateasks the journal daemon to rotate journal files. Journal file rotation has the effect that all currently active journal files are marked as archived and renamed, so that they are never written to in future. New (empty) journal files are then created in their place. Without this, active journal files are not removed by the--vacuum*=command.--vacuum-time=1smakes all journal files contain no data older than 1 second. You may change the--vacuum-timeperiod to suit your needs, e.g.1mfor 1 minute,2hfor 1 hour,2weeksfor 2 weeks,4monthsfor 4 months.
You may use
--vacuum-size instead of --vacuum-time (you may also use both in the same time), to remove the oldest archived journal files until the disk space they use falls below the specified size. Specify the --vacuum-size value followed by the usual "K", "M", "G" and "T" suffixes, e.g. journalctl --vacuum-size=100M to remove archived journal files until the disk space they use falls below 100M.I also want to note that on newer systemd versions (240 and newer, used for example in Ubuntu 19.04 and newer), you may combine the
--vacuum*= and --rotate commands. For example to rotate journal files and remove archived journal files until the disk space they use is under 500M, you could use:sudo journalctl --rotate --vacuum-size=500MThese commands are for usage on demand, when you want to clear the journal logs manually. But you can also configure journald to clear archived logs after they exceed a certain size on disk, or after a given amount of time. This can be done by editing the journald configuration file (
/etc/systemd/journald.conf), and uncommenting, then adding a value to SystemMaxUse= (e.g.: SystemMaxUse=100M to remove archived journal files until the disk space they use falls below 100M) and/or MaxFileSec= (.e.g. MaxFileSec=5day to make all journal files contain no data older than 5 days).You may also like:
