Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

journalctl - remove logs of a specific unit

Tags:

systemd

With journalctl, it is possible to remove the old logs, by specifying either the maximum disk space they can use, or the maximum age they can have, or the maximum number of separate journal files (using the options --vacuum-size, --vacuum-time or --vacuum-files).

Is there a way to restrain this deletion to a specific systemd unit ?

journalctl -u <unit> --vacuum-time=2d seems not to work as desired: according to the documentation, -u only works when displaying logs.

like image 440
audeoudh Avatar asked Apr 19 '16 12:04

audeoudh


People also ask

How do you sort logs as per priority in Journalctl?

By Priority You can use journalctl to display only messages of a specified priority or above by using the -p option. This allows you to filter out lower priority messages. For instance, to show only entries logged at the error level or above, you can type: journalctl -p err -b.

What is Journald logging?

Journald is a system service for collecting and storing log data, introduced with systemd. It tries to make it easier for system administrators to find interesting and relevant information among an ever-increasing amount of log messages.

Is Journalctl the same as syslog?

Systems with journalctl are journalling systems, which means that they used journal to work with all syslog entries. Default, this systems don't write logs to /var/log/secure, /var/log/maillog/ /var/log/messages... Both use syslog protocol, but can share.

How can you run Journalctl and see all log entries?

If you also use the -f (follow) option, journalctl will track new messages from this application as they arrive. You can search for log entries using the process ID of the process that generated the log message. Use the ps command to find the process id of the daemon or application you're going to search for.


2 Answers

After some research I found that you can't delete logs for a specific systemd unit, because the logs are interlaced and if you delete only one unit you'll corrupt the logs, so journalctl doesn't let you.

like image 117
user3144605 Avatar answered Sep 19 '22 16:09

user3144605


The self maintenance method is to vacuum the logs by size or time.

Retain only the past two days:

journalctl --vacuum-time=2d

Retain only the past 500 MB:

journalctl --vacuum-size=500M

Source: https://unix.stackexchange.com/questions/139513/how-to-clear-journalctl

like image 40
Nail Khaled Beneloualid Avatar answered Sep 19 '22 16:09

Nail Khaled Beneloualid