By default, systemd-journald ensures older journal records or journal files are deleted in order to keep a certain amount of disk space free. In the Linux Logging with Systemd section, we explain how to control the thresholds for deleting old log data with configuration parameters. We can also use journalctl to manage the size of the journal, which we’ll explain in more detail in this section.
To check how much disk space is currently taken up by the journal, use the –disk-usage parameter:
$ journalctl --disk-usage
Depending on the version of journalctl, the output can be similar to this:
Archived and active journals take up 96.0M on disk.
Journals take up 248.0M on disk.
You can also manage disk space taken up by systemd journal by fine-tuning these configuration parameters:
To delete archived journal entries manually, you can use either the –vacuum-size or the –vacuum-time option. In the example below, we are deleting any archived journal files, so the journal size comes back to 200MB.
$ journalctl --vacuum-size=200M
The output should be something similar to this.
Vacuuming done, freed 200M of archived journals from /var/log/journal/ebb94c86dc6447fba1f308728c4 2de55 on disk.
When using –vacuum-time option, archived journals older than the time specified will be deleted.
These two options are available from systemd version 218.
You can also use the --vacuum-files option, which deletes all but the specified number of journal files. For example, if you have 10 archived journal files and want to reduce these down to 2, you can do so by running the following command:
$ journalctl --vacuum-files=2
Note that this won’t delete any journal files that are actively in use.
To verify the journal for internal consistency, use the –verify option:
$ journalctl --verify
There will be a graphical progress bar as the check is done. Sometimes an alert message will be shown:
42a840: data object references invalid entry at 600f720 File corruption detected at /var/log/journal/6312944ca8d9f189228c76ab557a9109/system.journal:000000 (of 109051904 bytes, 0%). FAIL: /var/log/journal/6312944ca8d9f189228c76ab557a9109/system.journal (Bad message) If the test passes, the output will look similar to the following: PASS: /var/log/journal/ebb94c86dc6447fba1f308728c42de55/user-1000.journal PASS: /var/log/journal/ebb94c86dc6447fba1f308728c42de55/system.journal PASS: /email@example.com~ PASS: /firstname.lastname@example.org~