20.04 - Big /var/log/journal? - Ask Ubuntu

Ask Ubuntu is a question and answer site for Ubuntu users and developers. It only takes a minute to sign up.

Sign up to join this community
Anybody can ask a question
Anybody can answer
The best answers are voted up and rise to the top

# Big /var/log/journal?

Ask Question
Asked 2 years, 1 month ago
Modified 2 months ago
Viewed 84k times
149

I don't understand why the `/var/log/journal/` folder is so big.

For example, by executing the command `systemctl -f`, i see the fill. If I click on an email on Thunderbird, it generates dozens of lines that I consider useless.

Currently, I have more than 1.5GB (`du -h /var/log/journal/`) generated in 1 day!

Is there a method to reduce this log considerably without stopping logging?

20.04 disk-usage cleanup systemd-journald
edited Jun 14, 2021 at 13:57
TooTone
18622 silver badges1616 bronze badges
asked May 11, 2020 at 11:49
Bristow Bristow
1,53222 gold badges66 silver badges99 bronze badges
2

- 1
  For me it's 2.5G on one 18.04 machine and 4.0G on another. What's the issue with the size?
  – 0xC0000022L
  May 11, 2020 at 12:13
- 3
  "I don't understand why the /var/log/journal/ folder is so big." because it logs everything.
  – Rinzwind
  May 11, 2020 at 12:32

Add a comment |

## 3 Answers 3

Sorted by: Reset to default
150

You can diminish the size of the journal by means of these commands:

    journalctl --vacuum-size=100M

This will retain the most recent 100M of data.

    journalctl --vacuum-time=10d

will delete everything but the last 10 days.

From `man journalctl`:

> --vacuum-size=, --vacuum-time=, --vacuum-files= Removes the oldest archived journal files until the disk space they use falls below the specified size (specified with the usual "K", "M", "G" and "T" suffixes), or all archived journal files contain no data older than the specified timespan (specified with the usual "s", "m", "h", "days", "months", "weeks" and "years" suffixes), or no more than the specified number of separate journal files remain. Note that running --vacuum-size= has only an indirect effect on the output shown by --disk-usage, as the latter includes active journal files, while the vacuuming operation only operates on archived journal files. Similarly, --vacuum-files= might not actually reduce the number of journal files to below the specified number, as it will not remove active journal files.

> --vacuum-size=, --vacuum-time= and --vacuum-files= may be combined in a single invocation to enforce any combination of a size, a time and a number of files limit on the archived journal files. Specifying any of these three parameters as zero is equivalent to not enforcing the specific limit, and is thus redundant.

> These three switches may also be combined with --rotate into one command. If so, all active files are rotated first, and the requested vacuuming operation is executed right after. The rotation has the effect that all currently active files are archived (and potentially new, empty journal files opened as replacement), and hence the vacuuming operation has the greatest effect as it can take all log data written so far into account.

answered May 11, 2020 at 12:06
Jos Jos
24.2k88 gold badges7676 silver badges7979 bronze badges
6

- 5
  Might be sufficient for most but if I got 10 dollars for every time some co-worker asks me what happen on a specific date where that date was more than 10 days (heck 1 here dared to ask about something happend 6 years ago :D ) I'd be rich. Log rotate (last sentence) might be a better method for most and it might be nice to focus more on that part :)
  – Rinzwind
  May 11, 2020 at 12:35
- Vacuuming done, freed 3.7G of archived journals from /var/log/journal !
  – Tomachi
  Sep 10, 2020 at 3:05
- 12
  Perhaps this can be edited to show how to set journald growth limits. Teach people to vacuum and they mitigate the problem once. Teach them to edit /etc/systemd/journald.conf and you teach them how to solve the problem permanently. Also, while not asked, a little bit about why journald is even necessary vs. text syslogs. Rinzwind's comment might otherwise prevent people from controlling journald when they actually have most everything journald offers in another source.
  – Kurt Fitzner
  Sep 16, 2020 at 12:11
- 1
  After spending the afternoon carefully looking at documentation before proceeding with it, I run `journalctl --vacum-size=100M` thinking it would delete 100M of files in /var/log/journal ... I then see "Vacuuming done, freed 2.0G of archived journals", I'm an idiot! Oh well, not that I needed log files from March 2020 (I hope)
  – user199710
  Jan 30, 2021 at 18:33
- 1
  One last thing -- in a professional environment, you should be running a centralized logging system with sufficient space to store a year's worth of logs (possibly compressed) for every system in the company (or at least six months worth) so that if your network is compromised, the compromise can be tracked back in time. So journald keeping more than a few days of local logs is literally a waste of local disk space in a professional enviornment.
  – eric.green
  Jul 19, 2021 at 19:21

| Show 1 more comment
119

As @kurt-fitzner wrote:

> Teach them to edit `/etc/systemd/journald.conf` and you teach them how to solve the problem permanently.

More specifically: Activate the `SystemMaxUse=` option there, e.g. as `SystemMaxUse=100M` to only use 100 MB.

After editing, use `service systemd-journald restart` to activate the changed configuration. This will remove the excess logs.

journald.conf also has other options that might be useful.

edited Jun 2, 2021 at 8:22
answered Sep 18, 2020 at 15:44
Robert Pollak Robert Pollak
1,29411 gold badge88 silver badges1111 bronze badges
2

- 3
  `MaxRetentionSec` is the parameter in `/etc/systemd/journald.conf` that controls how long to keep journal files. This setting takes time values which may be suffixed with the units "year", "month", "week", "day", "h" or "m" to override the default time unit of seconds.
  – jeffmjack
  Feb 27, 2021 at 4:10
- 8
  After editing, `sudo service systemd-journald restart` takes the changes into account and vacuums.
  – slv
  May 18, 2021 at 12:55

Add a comment |
9

You also need to set this in `/etc/systemd/journald.conf`:

    SystemMaxFileSize=100M

See: https://got-tty.org/journalctl-via-journald-conf-die-loggroesse-definieren (in German)

edited Mar 29 at 12:29
Per Lundberg
13766 bronze badges
answered May 15, 2021 at 11:05
Chillio Chillio
9111 silver badge11 bronze badge
0

Add a comment |

## Your Answer

Thanks for contributing an answer to Ask Ubuntu!

- Please be sure to answer the question. Provide details and share your research!

But avoid …

- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

Draft saved
Draft discarded

### Sign up or log in

Sign up using Google
Sign up using Facebook
Sign up using Email and Password

### Post as a guest

Name
Email

Required, but never shown

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

## Not the answer you're looking for? Browse other questions tagged 20.04 disk-usage cleanup systemd-journald or ask your own question.