GrepBoard/Manuals
51 manuals ·

Check how much disk the systemd journal uses and shrink it

·Ubuntu 24.04 · systemd 255 · settings per freedesktop.org journald.conf(5) and journalctl(1)·6 steps

Check how much disk the journal uses, delete old files with vacuum, pin a size limit with a drop-in file, and find the units that fill the journal.

The journal keeps growing unless you cap it: check its size, shrink it once, then set a limit. The delete commands (step 3) were run on a copy (journal-copy), not on the live journal.

[1] Check how much space the journal uses. The figure covers archived and active files together.

console
# journalctl --disk-usageArchived and active journals take up 98.1M in the file system.

[2] Rotate first. --rotate asks the journal daemon to rotate the journal files.

console
# journalctl --rotate

Vacuum removes archived files only (the vacuuming operation only operates on archived journal files), so rotate first to make what the active file holds eligible.

[3] Vacuum by size, age, or file count. The output below comes from a copy of 85.4M, run with -D, which operates on the given directory instead of the default journal paths.

console
# journalctl -D journal-copy --vacuum-size=40MDeleted archived journal /var/log/journal/MID/system@….journal (4.5M).Deleted archived journal /var/log/journal/MID/user-1000@….journal (3.6M).…Vacuuming done, freed 47.6M of archived journals from /var/log/journal/MID.# journalctl -D journal-copy --disk-usageArchived and active journals take up 37.8M in the file system.
  • --vacuum-size=40M — delete the oldest archived files until usage drops below 40M.
  • --vacuum-time=2d — delete archived files older than 2 days. With no match it prints freed 0B.
  • --vacuum-files=2 — keep only 2 files. Active files are never removed, so the count may stay above the limit.
console
# journalctl -D journal-copy --vacuum-files=2Vacuuming done, freed 26.4M of archived journals from /var/log/journal# journalctl -D journal-copy --disk-usageArchived and active journals take up 11.3M in the file system.

[4] Pin the limit with a drop-in file. Put a .conf file in /etc/systemd/journald.conf.d/ instead of editing journald.conf. When several files set the same option, the file sorted last wins.

/etc/systemd/journald.conf.d/size.conf
[Journal]+SystemMaxUse=200M+SystemKeepFree=1G+SystemMaxFileSize=16M+MaxRetentionSec=1month
  • SystemMaxUse= — maximum disk space the journal may use.
  • SystemKeepFree= — disk space to leave free for other uses.
  • SystemMaxFileSize= — maximum size of one journal file.
  • MaxRetentionSec= — maximum retention time. The default 0 turns it off.

[5] Restart journald so it reads the setting.

console
# mkdir -p /etc/systemd/journald.conf.d# systemctl restart systemd-journald# journalctl --disk-usage

[6] Find the units that fill the journal. Count entries per unit for the current boot.

console
# journalctl -b -o json --output-fields=_SYSTEMD_UNIT --no-pager | grep -o '"_SYSTEMD_UNIT":"[^"]*"' | sed 's/"_SYSTEMD_UNIT":"//;s/"$//' | sort | uniq -c | sort -rn | head -4   4042 ssh.service   2963 user@0.service   2906 init.scope   2554 systemd-logind.service

-p err shows err and more important levels (crit, alert, emerg). -b limits output to the current boot.

console
# journalctl -p err -b --no-pagerOct 19 06:54:04 server1 kernel: DMAR-IR: [Firmware Bug]: ioapic 2 has no mapping iommu, interrupt remapping wi…Oct 19 06:54:06 server1 kernel: b43-phy0 ERROR: Firmware file "b43/ucode29_mimo.fw" not found

Analyze your syslog · journal log in the browser ↗ — nothing is uploaded.

#journalctl#systemd#disk