In Linux, the journal is part of the system which comprises all the information regarding kernel or boot messages, Syslog messages, etc., stored in the journal file. The centralized location is available in the “/var/log/” directory. The logs in that file make it huge sometimes, which needs to be cleaned up to have a smooth system performance (just like the cache).
In this post, we will demonstrate the possible solutions to deal with the huge size of the /var/log/journal. Let’s get into it:
- How to Clean Up /var/log/journal File?
- Method 1: Using the –vacuum-size Option of the journalctl Command
- Method 2: Using the –vacuum-time Option of the journalctl Command
- Method 3: Using the –vacuum-files Option of the journalctl Command
Let’s get started.
How to Clean Up /var/log/journal File?
The reason for the increase in the file size is that logs are not cleaned up. To check the overall space occupied by the “var/log/journal” file, use the below-stated command:
$ journalctl --disk-usage
The output shows that the disk space occupied by the journal files is “472.1MB”. Now, let’s examine the methods to overcome the large journal log files.
Method 1: Using the –vacuum-size Option of the journalctl Command
The “–vacuum-size”is the option that is used for limiting the disk usage of journal files and will limit the size of the “/var/log/journal” file. For instance, the command provided below will limit the size of journal files to 100MB:
$ sudo journalctl --vacuum-size=100M
Limiting the size of the journal logs will stop more using space, but it will not delete the existing files.
Note: Only archived Files will be deleted to reduce the journal log size.
Restart the journal service to update the changes:
$ sudo service systemd-journald restart
Method 2: Using the –vacuum-time Option of the journalctl Command
The “–vacuum-time” is the option used for deleting the old journal files with time such as hours, days, and years. You can use this to clear your journal files. To do so, execute the below command in the terminal:
$ sudo journalctl --vacuum-time=5d
In our scenario, we have deleted the old journal logs for the last 5 days.
Then restart the journal service to activate the changes using the below command:
$ sudo service systemd-journald restart
Method 3: Using the –vacuum-files Option of the journalctl Command
The “–vacuum-files” is the option that is also used for deleting the old files in a journal. This option will clear the journal by limiting the number of files:
$ sudo journalctl --vacuum-files=2
The above command will reduce the number of files to 2 by deleting the old files.
Note: The “–vacuum-files” option will not delete the files that are currently active or in use.
Restart the journal service to apply the new changes:
$ sudo service systemd-journald restart
After that user can verify the journal for internal consistency:
$ journalctl --verify
That’s it from this guide.
Conclusion
To resolve the big size issue of “/var/log/journal” in Linux, reduce the size of the journal log files by using the “ sudo journalctl –vacuum-size=<size-in-MB>” and “sudo journalctl –vacuum-time=<hours/weeks/months/years>” command. After that, restart the journal service using the “sudo service systemd-journald restart” command and verify the journal for internal consistency by running the “journalctl –verify” command. This post has demonstrated the possible solutions to eliminate the large size of “/var/log/journal” in Linux.
