/var/log/journal larger than exepected

Ask Fedora
1

Hi,
I recently tried to trim the disk usage of /var/log/journal . So I created an additional:

# /etc/systemd/journald.conf.d/journald.conf
# eigene Spezifikationen für journald
SystemMaxUse=500M
MaxFileSec=14day

I restarted with:

sudo systemctl restart systemd-journald.service

but

systemctl status systemd-journald.service

still reports:

systemctl status systemd-journald.service -l
● systemd-journald.service - Journal Service
     Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static)
     Active: active (running) since Fri 2022-04-01 15:23:00 CEST; 33s ago
TriggeredBy: ● systemd-journald-dev-log.socket
             ● systemd-journald-audit.socket
             ● systemd-journald.socket
       Docs: man:systemd-journald.service(8)
             man:journald.conf(5)
   Main PID: 5882 (systemd-journal)
     Status: "Processing requests..."
      Tasks: 1 (limit: 18942)
     Memory: 1.2M
        CPU: 24ms
     CGroup: /system.slice/systemd-journald.service
             └─5882 /usr/lib/systemd/systemd-journald

Apr 01 15:23:00 fedora systemd-journald[5882]: Journal started
Apr 01 15:23:00 fedora systemd-journald[5882]: System Journal (/var/log/journal/99fccdaed26947e39447545957fd62b9) is 617.7M, max 997.9M, 380.1M free.

Why is still 617M used and 997M allowed?

Thank you in advance.

2

I could be wrong, but I believe that takes effect for nearly created journal files as they are regularly rotated, so this way it doesn’t truncate existing logs unintentionally.

3

Thank you for your remark. I checked the directory in

/var/log/journal/99fccdaed26947e39447545957fd62b9

The oldest files are created 16th of march, so they are older than 14 days.
The largest files are 130MB, thes are the ones created 16th of march. So I would expect that at least MaxFileSec=14day would cleanup.

4

I’m not sure when they are rotated, but I’m curious if you still see them since it’s presumably been 24h now since you made the change. I assume whatever logrotate/journald rotation process should have ran by now. It might also be worth seeing if a reboot helps things.

5

No, rebooting does not change anything:

[jojo@fedora ~]$ journalctl --disk-usage
Archived and active journals take up 689.7M in the file system.

[jojo@fedora ~]$ systemd-analyze cat-config systemd/journald.conf
# /etc/systemd/journald.conf
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it under the
#  terms of the GNU Lesser General Public License as published by the Free
#  Software Foundation; either version 2.1 of the License, or (at your option)
#  any later version.
#
# Entries in this file show the compile time defaults. Local configuration
# should be created by either modifying this file, or by creating "drop-ins" in
# the journald.conf.d/ subdirectory. The latter is generally recommended.
# Defaults can be restored by simply deleting this file and all drop-ins.
#
# Use 'systemd-analyze cat-config systemd/journald.conf' to display the full config.
#
# See journald.conf(5) for details.

[Journal]
#Storage=auto
#Compress=yes
#Seal=yes
#SplitMode=uid
#SyncIntervalSec=5m
#RateLimitIntervalSec=30s
#RateLimitBurst=10000
#SystemMaxUse=
#SystemKeepFree=
#SystemMaxFileSize=
#SystemMaxFiles=100
#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=
#RuntimeMaxFiles=100
#MaxRetentionSec=
#MaxFileSec=1month
#ForwardToSyslog=no
#ForwardToKMsg=no
#ForwardToConsole=no
#ForwardToWall=yes
#TTYPath=/dev/console
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#MaxLevelWall=emerg
#LineMax=48K
#ReadKMsg=yes
#Audit=yes

# /etc/systemd/journald.conf.d/journald.conf
# eigene Spezifikationen für journald
SystemMaxUse=500M
MaxFileSec=14day
6

If you want to manually clean them, you could

journalctl --vacuum-time=30days

or however many days you want to keep.

1 Like
7

Before F35 I successfuly used

journalctl --vacuum-size=500M

But now my intention is to manage this permanently with journald…