Free disk space taken by log files

[viking60]

Linux with systemd, logs just about everything - and it will grow a lot as time goes by.
Just type

Code: Select all

journalctl

to see what you have logged.
On servers that may be good but much of that is not necessary on a Desktop - at least not so much of it.
But don't get me wrong: journalctl is a great tool to find what is going on; you can type

Code: Select all

journalctl -b -p err

to list only errors and lots more.

As I said I do not need so much of it.

I checked how much systemd was logging on my disk with:

Code: Select all

journalctl --disk-usage

And received a shock when it came up with several gigabytes.
Then I edited /etc/systemd/journald.conf
And set a maximum size for the log:

Code: Select all

SystemMaxUse=100M


It only needed to be uncommented and me providing a value of 100M.
I also set this:

Code: Select all

SystemMaxFileSize=10M

That should do it! But after a reboot I still had a load of old entries so it was time for some berserk style:
I stopped the journalservice

Code: Select all

systemctl stop systemd-journald.service

And here is the Berserk bit; I removed the journal directory with (a s...load of) contents

Code: Select all

cd /var/log

Code: Select all

rm -r journal

...
Less brave non Berserks (chickens) may consider moving the journal:

Code: Select all

mv journal journal_backup

...
Then I re-created an empty journal in /var/log

Code: Select all

mkdir journal

Time to start the logging enchilada again then:

Code: Select all

 systemctl start systemd-journald.service

Now the

Code: Select all

journalctl --disk-usage

showed 0 zero, and after a reboot the data started to flow again.
7G saved and now the data will not exceed approximately 100M (if systemd needs more space to log an ongoing operation in a file, it will take the extra space the file needs).

If I will miss those boot messages from february 2013?

Nope - not at all.

[Snorkasaurus]

I like to keep logs from servers in case I ever need to go back and look for signs of an attack or compromise. Being plain text makes log files great candidates for compressing (which most systems do automatically now anyways). I like to keep about 3 to 6 months worth of logs on a live server and groom the rest off to backup drives. heh, I have logs dating back to the mid nineties but don't worry, I don't share them with my cell provider or the NSA. :-)

S.

[jkerr82508]

I just delete the old journal files. I usually keep the current journal and one old journal for the system and my user. Since I only re-boot about once a month, it's not difficult to do this after a reboot. I suppose it would be possible to automate that with a cron job, if one was so inclined.

Jim