logrotate does not touch the systemd journal: journald rotates and cleans its own files.
Journal records live in /var/log/journal/. They are written to the active file, system.journal. When it reaches its limit, journald closes it — the file becomes an archive named like system@…journal — and starts a new active one. sudo journalctl --disk-usage shows how much all the files take together; on the training machine it is 16.0M.
The limits are set in the journald settings: SystemMaxFileSize is the size of one file, SystemMaxUse that of all journal files. New values take effect after journald restarts.
journalctl frees space right away: --vacuum-size=200M removes the oldest archives until they take less than 200M, --vacuum-time=2weeks removes archives older than two weeks. --rotate turns the active file into an archive.
journald can also run separate journal namespaces — instances with their own files and settings, /etc/systemd/journald@NAME.conf. Commands pick a namespace with --namespace=NAME. In the exercise and in the module's lab you work with such a namespace, and the machine's main journal stays untouched.
The systemd journal has taken too much space, and its growth must be stopped for the future. What do you do?
-
vacuum removes archives that have already piled up and does not limit growth between runs.
SystemMaxUsesets the limit for the future. -
rmbehind journald's back frees space once and may delete a file journald is writing to.journalctl --vacuum-sizeremoves archives, andSystemMaxUselimits growth.
journald enforces SystemMaxUse on its own: when it reaches the limit, it removes old archives. --vacuum-size is for freeing space right away.
Key points
- journald writes to the active file and turns it into an archive once it is full.
-
SystemMaxUselimits the journal for the future,--vacuum-sizeremoves the archives that piled up. -
--namespace=NAMEpicks a separate journal namespace with its own files.