systemd-journald is a service that collects and stores logging data, creating structured, indexed journals based on the logging information it receives. But sometimes the logs produced are so large that you have to remove and limit the journal log.
Problem
How to remove and limit journal log size in Linux?
Solution
By default, the log journal is in the folder/var/log/journal and will retain 4 GB of data. You can limit the log size by using the format below:
journalctl --vacuum-size=BYTES
If you want to remove the journal log to 100 MB, you can use the command below:
journalctl --vacuum-size=100M
The journal log size will reduce to around 100 MB, like in the image below, after you execute the above command:
You can also make the journal log remain 100 MB without running the command above by configuring it in the journald.conf file. But the file is in a different folder in each Linux distro, so you have to search for the file using the following command:
find / -name journald.conf
After you find the file, for example, you want to limit the journal log to only 100 MB, then change the file so that it looks like the following:
[Journal]
SystemMaxUse=100MB
After that, restart the journald service using the command below:
systemctl restart systemd-journald.service
The journal log size should be produced in the folder /var /log, only measuring about 100 MB.
Note
If you want to test to generate lots of logging quickly, you can use the following command:
while true; do dd if=/dev/urandom bs=3 count=10000 | base64 | logger; done
At the same time, you can execute the following command to display the size of the journal log in another terminal:
while true; do du -s /var/log/journal/ ; sleep 5 ;done
What you should know is that the journal should not be disabled, especially if you use rsyslogd, because rsyslogd can get its information from journald, and they play very well together this way.
References
reintech.io
sematext.com
andreaskaris.github.io
unix.stackexchange.com
