By A Linux system running with systemd-journald can eventually run into a low disk space event. The logs are located under /var/log/journal and are not readable using commands such as cat or less.
If you are or have been using a syslog daemon, such as rsyslog or syslog-ng, you might be used to readable logs (text files) and a recurring log rotation. Hence it might be confusing when dealing with systemd-journald (= journal) logs.
There is a log rotation happening, however the rotated logs are not compressed – using more and more disk space over time.
Dealing with journals (systemd-journald logs)
Use the journalctl command to read and manage journals.
The manual vacuum operation
To manually clean up old journals, you can use the vacuum operation from the journalctl command. The following example uses the –vacuum-size parameter and sets a limit of 512M. This means all journals are cleaned up and only the most recent 512 MB will be kept:
root@linux:~ # journalctl --vacuum-size 512M
Vacuuming done, freed 0B of archived journals from /var/log/journal.
Vacuuming done, freed 0B of archived journals from /run/log/journal.
Deleted archived journal /var/log/journal/e63c1fc10f3e4a79bcb7375481edb166/user-1000@17ee58399515442ab1d513fe19c2afe4-0000000000b1bb75-000632175445d8f9.journal (8.0M).
Deleted archived journal /var/log/journal/e63c1fc10f3e4a79bcb7375481edb166/user-1004@b66b6350a0514ff788473feea3d52d70-0000000000b2f1a5-000632733398a1fa.journal (112.0M).
[...]
Vacuuming done, freed 1.2G of archived journals from /var/log/journal/e63c1fc10f3e4a79bcb7375481edb166.The final line shows how much disk space was freed by the vacuum operation. In this situation, 1.2 GB of old journals were deleted from the file system.
Set a disk usage limit
You can also configure systemd-journald to limit the disk usage. Similar to the vacuum operation above, you can tell systemd-journald to never use more than 512 MB of the file system. By default no limit on the disk usage is defined.
To do so, locate the systemd-journald configuration file – usually under /etc/systemd/journald.conf. Open and edit the file with your favourite editor (Note: You must have root privileges to do so).
Under the [Journal] context, add the following line:
SystemMaxUse=512MAdjust the value to your needs.
Finalize the change with a restart of systemd-journald:
root@linux:~ # systemctl restart systemd-journaldThat's it! From now on your Linux machine will use a fixed size of journals.
