Ultimate Guide to Logging

                    Your open-source resource for understanding, analyzing, and troubleshooting system logs

                    Managing Journal Size

                    By default, systemd-journald ensures older journal records or journal files are deleted in order to keep a certain amount of disk space free. In the Linux Logging with Systemd section, we explain how to control the thresholds for deleting old log data with configuration parameters. We can also use journalctl to manage the size of the journal, which we’ll explain in more detail in this section.

                    To check how much disk space is currently taken up by the journal, use the –disk-usage parameter:

                    $ journalctl --disk-usage

                    Depending on the version of journalctl, the output can be similar to this:

                    Archived and active journals take up 96.0M on disk.

                    or:

                    Journals take up 248.0M on disk.

                    You can also manage disk space taken up by systemd journal by fine-tuning these?configuration parameters:

                    • COMPRESS
                    • SYSTEMKEEPFREE
                    • RUNTIMEKEEPFREE
                    • SYSTEMMAXFILESIZE
                    • RUNTIMEMAXFILESIZE
                    • MAXRETENTIONSEC
                    • MAXFILESEC

                    Deleting or Vacuuming Journals

                    To delete archived journal entries manually, you can use either the –vacuum-size or the –vacuum-time option. In the example below, we are deleting any archived journal files, so the journal size comes back to 200MB.

                    $ journalctl --vacuum-size=200M

                    The output should be something similar to this.

                    Vacuuming done, freed 200M of archived journals from /var/log/journal/ebb94c86dc6447fba1f308728c4
                    
                    2de55
                    
                    on disk.

                    When using –vacuum-time option, archived journals older than the time specified will be deleted.

                    These two options are available from systemd version 218.

                    You can also use the --vacuum-files option, which deletes all but the specified number of journal files. For example, if you have 10 archived journal files and want to reduce these down to 2, you can do so by running the following command:

                    $ journalctl --vacuum-files=2

                    Note that this won’t delete any journal files that are actively in use.

                    Verifying Journals

                    To verify the journal for internal consistency, use the –verify option:

                    $ journalctl --verify

                    There will be a graphical progress bar as the check is done. Sometimes an alert message will be shown:

                    42a840: data object references invalid entry at 600f720
                    
                    File corruption detected at /var/log/journal/6312944ca8d9f189228c76ab557a9109/system.journal:000000 (of 109051904 bytes, 0%).
                    
                    FAIL: /var/log/journal/6312944ca8d9f189228c76ab557a9109/system.journal (Bad message)
                    
                    If the test passes, the output will look similar to the following:
                    
                    PASS: /var/log/journal/ebb94c86dc6447fba1f308728c42de55/user-1000.journal
                    
                    PASS: /var/log/journal/ebb94c86dc6447fba1f308728c42de55/system.journal
                    
                    PASS: /var/log/journal/ebb94c86dc6447fba1f308728c42de55/system@00058c1aae2cfb13-b514d537186475f7.journal~
                    
                    PASS: /var/log/journal/ebb94c86dc6447fba1f308728c42de55/user-1000@00058c1aae5a2638-470aa0f248caea09.journal~
                    日本熟妇色一本在线视频