<strike id="5nlrn"></strike>
<span id="5nlrn"><video id="5nlrn"><strike id="5nlrn"></strike></video></span>
<ruby id="5nlrn"></ruby>
<strike id="5nlrn"></strike>
<strike id="5nlrn"></strike>
<span id="5nlrn"><video id="5nlrn"><strike id="5nlrn"></strike></video></span>
<span id="5nlrn"><i id="5nlrn"></i></span>
<span id="5nlrn"></span>
<span id="5nlrn"></span>
<span id="5nlrn"></span>
<strike id="5nlrn"></strike>
<strike id="5nlrn"></strike>
<strike id="5nlrn"></strike><span id="5nlrn"></span>

From now through May 31, 2020, get up to 50% off the current pricing you are paying for other log management products. *New customers only. Learn more here.

Ultimate Guide to Logging

Your open-source resource for understanding, analyzing, and troubleshooting system logs

Managing Journal Size

By default, systemd-journald ensures older journal records or journal files are deleted in order to keep a certain amount of disk space free. In the Linux Logging with Systemd section, we explain how to control the thresholds for deleting old log data with configuration parameters. We can also use journalctl to manage the size of the journal, which we’ll explain in more detail in this section.

To check how much disk space is currently taken up by the journal, use the –disk-usage parameter:

$ journalctl --disk-usage

Depending on the version of journalctl, the output can be similar to this:

Archived and active journals take up 96.0M on disk.


Journals take up 248.0M on disk.

You can also manage disk space taken up by systemd journal by fine-tuning these?configuration parameters:


Deleting or Vacuuming Journals

To delete archived journal entries manually, you can use either the –vacuum-size or the –vacuum-time option. In the example below, we are deleting any archived journal files, so the journal size comes back to 200MB.

$ journalctl --vacuum-size=200M

The output should be something similar to this.

Vacuuming done, freed 200M of archived journals from /var/log/journal/ebb94c86dc6447fba1f308728c4


on disk.

When using –vacuum-time option, archived journals older than the time specified will be deleted.

These two options are available from systemd version 218.

You can also use the --vacuum-files option, which deletes all but the specified number of journal files. For example, if you have 10 archived journal files and want to reduce these down to 2, you can do so by running the following command:

$ journalctl --vacuum-files=2

Note that this won’t delete any journal files that are actively in use.

Verifying Journals

To verify the journal for internal consistency, use the –verify option:

$ journalctl --verify

There will be a graphical progress bar as the check is done. Sometimes an alert message will be shown:

42a840: data object references invalid entry at 600f720

File corruption detected at /var/log/journal/6312944ca8d9f189228c76ab557a9109/system.journal:000000 (of 109051904 bytes, 0%).

FAIL: /var/log/journal/6312944ca8d9f189228c76ab557a9109/system.journal (Bad message)

If the test passes, the output will look similar to the following:

PASS: /var/log/journal/ebb94c86dc6447fba1f308728c42de55/user-1000.journal

PASS: /var/log/journal/ebb94c86dc6447fba1f308728c42de55/system.journal

PASS: /var/log/journal/ebb94c86dc6447fba1f308728c42de55/system@00058c1aae2cfb13-b514d537186475f7.journal~

PASS: /var/log/journal/ebb94c86dc6447fba1f308728c42de55/user-1000@00058c1aae5a2638-470aa0f248caea09.journal~