How to clear journalctl
Clash Royale CLAN TAG#URR8PPP
up vote
148
down vote
favorite
I couldn't find in google any safe way to clear systemd journal. Do anyone know any safe and reliable way to do so?
Let's say I was experimenting with something and my logs got cluttered with various error messages. Moreover I'm displaying my journal on my desktop by using Conky. I really don't want to see those errors as they remind me an awful day I was fixing this stuff, I want to feel like a fresh man after this horror. I think everyone will agree that this is a valid reason to clear the logs :P .
systemd systemd-journald
edited Sep 23 '17 at 20:13
sourcejedi
20.6k42888
asked Jun 27 '14 at 11:43
Ã…Âukasz Zaroda
9762812
add a comment |Â
up vote
148
down vote
favorite
I couldn't find in google any safe way to clear systemd journal. Do anyone know any safe and reliable way to do so?
Let's say I was experimenting with something and my logs got cluttered with various error messages. Moreover I'm displaying my journal on my desktop by using Conky. I really don't want to see those errors as they remind me an awful day I was fixing this stuff, I want to feel like a fresh man after this horror. I think everyone will agree that this is a valid reason to clear the logs :P .
systemd systemd-journald
edited Sep 23 '17 at 20:13
sourcejedi
20.6k42888
asked Jun 27 '14 at 11:43
Ã…Âukasz Zaroda
9762812
add a comment |Â
up vote
148
down vote
favorite
up vote
148
down vote
favorite
I couldn't find in google any safe way to clear systemd journal. Do anyone know any safe and reliable way to do so?
Let's say I was experimenting with something and my logs got cluttered with various error messages. Moreover I'm displaying my journal on my desktop by using Conky. I really don't want to see those errors as they remind me an awful day I was fixing this stuff, I want to feel like a fresh man after this horror. I think everyone will agree that this is a valid reason to clear the logs :P .
systemd systemd-journald
edited Sep 23 '17 at 20:13
sourcejedi
20.6k42888
asked Jun 27 '14 at 11:43
Ã…Âukasz Zaroda
9762812
I couldn't find in google any safe way to clear systemd journal. Do anyone know any safe and reliable way to do so?
Let's say I was experimenting with something and my logs got cluttered with various error messages. Moreover I'm displaying my journal on my desktop by using Conky. I really don't want to see those errors as they remind me an awful day I was fixing this stuff, I want to feel like a fresh man after this horror. I think everyone will agree that this is a valid reason to clear the logs :P .
systemd systemd-journald
systemd systemd-journald
edited Sep 23 '17 at 20:13
sourcejedi
20.6k42888
asked Jun 27 '14 at 11:43
Ã…Âukasz Zaroda
9762812
edited Sep 23 '17 at 20:13
sourcejedi
20.6k42888
asked Jun 27 '14 at 11:43
Ã…Âukasz Zaroda
9762812
edited Sep 23 '17 at 20:13
sourcejedi
20.6k42888
edited Sep 23 '17 at 20:13
sourcejedi
20.6k42888
edited Sep 23 '17 at 20:13
sourcejedi
20.6k42888
20.6k42888
asked Jun 27 '14 at 11:43
Ã…Âukasz Zaroda
9762812
asked Jun 27 '14 at 11:43
Ã…Âukasz Zaroda
9762812
asked Jun 27 '14 at 11:43
Ã…Âukasz Zaroda
9762812
9762812
add a comment |Â
add a comment |Â
8 Answers
8
active
oldest
votes
up vote
193
down vote
accepted
The self maintenance method is to vacuum the logs by size or time.
Retain only the past two days:
journalctl --vacuum-time=2d
Retain only the past 500 MB:
journalctl --vacuum-size=500M
man journalctl for more information.
answered Apr 2 '15 at 16:43
Michael
1,954162
9
Nice command, but didn't work for me on openSUSE 13.2 (the current stable release). It's known that Arch is usually at the cutting edge when it comes to kernel and userland programs, so I speculated that vacuum options might have been recently added to systemd and simply haven't precipitated down into my distro. Confirmed the fact here in Lennart's announcement on Dec 10 2014 techupdates.com/go/1002774 that this command was added in systemd v218. Just adding this comment incase any one else like me who is not on Arch has a similar issue. Upvoted anyway.
– Joshua Huber
Apr 23 '15 at 0:33
I just used 'journalctl --vacuum-time=1d' to fix a situation where new log messages weren't showing with 'journalctl -f'. Apparently my system time had temporarily jumped about a day forward for a while, then recovered, and journalctl was using the log event timestamps from that future time as the journal tail.
– user5071535
Nov 16 '15 at 18:23
7
Didn't work in version "systemd 229" on Ubuntu 16.04.journalctl --vacuum-size=1Kthenjournalctlstill shows way more than 1K. It shows all the messages since the last boot.
– Dan Dascalescu
Sep 10 '16 at 4:23
11
It seems that this only clears archived logs, not active ones. I tried runningjournalctl --flush --rotatebeforejournalctl --vacuum-time=1sand it removed more stuff, although still not everything.
– user60039
Feb 7 '17 at 19:42
1
The documentation doesn't seem so clear to me. Does it always stay set to 2d (in your example)? Or is 2d from the time you run the command? Maybe I'm not understanding how this works exactly.
– jersey bean
Aug 3 '17 at 1:49
 |Â
show 2 more comments
up vote
50
down vote
You don't typically clear the journal yourself. That is managed by systemd itself and old logs are rotated out as new data comes in. The correct thing to do would be to schedule journald to only keep as much data as you are interested in. The most usual thing to adjust is the total disk space it is allowed to take up. Once it crosses this boundry it will start pitching old entries to stay near this value.
You can set this in /etc/systemd/journald.conf like so:
SystemMaxUse=100M
answered Jun 27 '14 at 11:52
Caleb
49.3k9146187
10
Ok, but there are also untypical situations. I know that most of them is just aesthetics as a reason, but aesthetics is a valid reason for human being ;) .
– ÅÂukasz Zaroda
Jun 27 '14 at 12:08
1
@Ã…ÂukaszZaroda In that case you are going to have to define "safe". Normally "I want to blow away something that a daemon is configured to keep" is incompatible with "safe". If you want to force it just shut down the service and zero out the log files. If you want it to work normally you should define the parameters in your question better. What do you mean by "safe"?
– Caleb
Jun 27 '14 at 12:17
By safe, I mean that after clearing it will work as usual, just starting from the new place.
– ÅÂukasz Zaroda
Jun 27 '14 at 12:19
5
It may be not typical situation but sometimes it is necessary to delete old logs due to some systemd's bugs, e.g. bbs.archlinux.org/viewtopic.php?pid=1173031#p1173031
– diffycat
Jun 27 '14 at 15:57
1
To clean logs after a period of time rather than when they reach a certain size, you can set the parameterMaxRetentionSecinstead ofSystemMaxUse. Seeman journald.conffor more details.
– joelostblom
Mar 29 at 13:08
 |Â
show 1 more comment
up vote
10
down vote
On Arch linux, the closest I got was:
- Edit /etc/systemd/journald.conf to set SystemMaxUse=1M
- Restarting journal:
sudo systemctl restart systemd-journald - Resetting SystemMaxUse=200M
- Re-Restarting the journal
On my system, each journal file is 8MB, and the above cleared all but 3, bringing the total size to ~25MB.
My use-case was disabling CoW for BTRFS (just for the journal directory and subdirectories): sudo chattr +C /var/log/journal/*. The problem is, the attribute is only set on newly-created files, thus the desire to flush the journal.
answered Feb 11 '15 at 23:53
helmingstay
11913
4
Your use-case was actually not needed. The point of disabling CoW on the journal is that it is frequently written to. That is not the case for the old rotated journal files, they just sit there.
– Hjulle
Mar 31 '15 at 10:03
I've setSystemMaxUse=1K, restartedsystemd-journald, but journalctl still shows entries I want gone. How is this progress from flat text files?
– Dan Dascalescu
Sep 10 '16 at 4:18
add a comment |Â
up vote
10
down vote
A very brute force method to clean the entire log:
$ sudo journalctl --vacuum-time=1seconds
You can also use --vacuum-size as Michael mentoined.
answered Jul 6 '15 at 18:18
Lanti
28029
5
Didn't work. Entries for 15 minutes ago still show up, even after runningsystemctl restart systemd-journald.
– Dan Dascalescu
Sep 10 '16 at 4:15
1
Same here. This didn't work for me either. I'm running CentOS7.
– jersey bean
Aug 3 '17 at 1:55
add a comment |Â
up vote
6
down vote
Since --vacuum-time and --vacuum-size didn't do a thing for me I did the following:
$ find /var/log/journal -name "*.journal" | xargs sudo rm
$ sudo systemctl restart systemd-journald
It's not right, but it worked.
answered Dec 30 '16 at 22:08
Matt
20425
On Debian Jessie, the path is/run/log.
– Synchro
Feb 12 at 18:23
add a comment |Â
up vote
5
down vote
Michael's answer is missing one thing: vacuuming only removes archived journal files, not active ones. To get rid of everything, you need to rotate the files first so that recent entries are moved to inactive files.
So, the complete answer to remove all entries seems to be
journalctl --rotate
journalctl --vacuum-time=1s
(Note that you cannot combine this into one journalctl command.)
By the way, some distributions have journald configured so that it writes logs to disk (/var/log/journal) while others keep logs in memory (/run/log/journal). I expect that in some cases it may be necessary to use journalctl --flush first to get everything removed.
answered Jul 23 at 9:48
Jan Warchoł
353317
Yep, gotta rotate first. Thanks!
– math2001
Sep 9 at 4:16
journalctl: unrecognized option '--rotate'
– stiv
yesterday
add a comment |Â
up vote
0
down vote
journal-ctl -b-0 will show only from the most recent boot. You can also use -1, -2 etc. Your horrendous day is still there but you won't have to see it, unless you need to.
answered Jun 1 '15 at 11:11
David
91
add a comment |Â
up vote
0
down vote
Both --rotate and --vacuum-time=1s didn't work for me on CentOS. I was able to clear it like this:
sudo rm -rf /run/log/journal/*
answered yesterday
stiv
1652414
add a comment |Â
8 Answers
8
active
oldest
votes
8 Answers
8
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
193
down vote
accepted
The self maintenance method is to vacuum the logs by size or time.
Retain only the past two days:
journalctl --vacuum-time=2d
Retain only the past 500 MB:
journalctl --vacuum-size=500M
man journalctl for more information.
answered Apr 2 '15 at 16:43
Michael
1,954162
9
Nice command, but didn't work for me on openSUSE 13.2 (the current stable release). It's known that Arch is usually at the cutting edge when it comes to kernel and userland programs, so I speculated that vacuum options might have been recently added to systemd and simply haven't precipitated down into my distro. Confirmed the fact here in Lennart's announcement on Dec 10 2014 techupdates.com/go/1002774 that this command was added in systemd v218. Just adding this comment incase any one else like me who is not on Arch has a similar issue. Upvoted anyway.
– Joshua Huber
Apr 23 '15 at 0:33
I just used 'journalctl --vacuum-time=1d' to fix a situation where new log messages weren't showing with 'journalctl -f'. Apparently my system time had temporarily jumped about a day forward for a while, then recovered, and journalctl was using the log event timestamps from that future time as the journal tail.
– user5071535
Nov 16 '15 at 18:23
7
Didn't work in version "systemd 229" on Ubuntu 16.04.journalctl --vacuum-size=1Kthenjournalctlstill shows way more than 1K. It shows all the messages since the last boot.
– Dan Dascalescu
Sep 10 '16 at 4:23
11
It seems that this only clears archived logs, not active ones. I tried runningjournalctl --flush --rotatebeforejournalctl --vacuum-time=1sand it removed more stuff, although still not everything.
– user60039
Feb 7 '17 at 19:42
1
The documentation doesn't seem so clear to me. Does it always stay set to 2d (in your example)? Or is 2d from the time you run the command? Maybe I'm not understanding how this works exactly.
– jersey bean
Aug 3 '17 at 1:49
 |Â
show 2 more comments
up vote
193
down vote
accepted
The self maintenance method is to vacuum the logs by size or time.
Retain only the past two days:
journalctl --vacuum-time=2d
Retain only the past 500 MB:
journalctl --vacuum-size=500M
man journalctl for more information.
answered Apr 2 '15 at 16:43
Michael
1,954162
9
Nice command, but didn't work for me on openSUSE 13.2 (the current stable release). It's known that Arch is usually at the cutting edge when it comes to kernel and userland programs, so I speculated that vacuum options might have been recently added to systemd and simply haven't precipitated down into my distro. Confirmed the fact here in Lennart's announcement on Dec 10 2014 techupdates.com/go/1002774 that this command was added in systemd v218. Just adding this comment incase any one else like me who is not on Arch has a similar issue. Upvoted anyway.
– Joshua Huber
Apr 23 '15 at 0:33
I just used 'journalctl --vacuum-time=1d' to fix a situation where new log messages weren't showing with 'journalctl -f'. Apparently my system time had temporarily jumped about a day forward for a while, then recovered, and journalctl was using the log event timestamps from that future time as the journal tail.
– user5071535
Nov 16 '15 at 18:23
7
Didn't work in version "systemd 229" on Ubuntu 16.04.journalctl --vacuum-size=1Kthenjournalctlstill shows way more than 1K. It shows all the messages since the last boot.
– Dan Dascalescu
Sep 10 '16 at 4:23
11
It seems that this only clears archived logs, not active ones. I tried runningjournalctl --flush --rotatebeforejournalctl --vacuum-time=1sand it removed more stuff, although still not everything.
– user60039
Feb 7 '17 at 19:42
1
The documentation doesn't seem so clear to me. Does it always stay set to 2d (in your example)? Or is 2d from the time you run the command? Maybe I'm not understanding how this works exactly.
– jersey bean
Aug 3 '17 at 1:49
 |Â
show 2 more comments
up vote
193
down vote
accepted
up vote
193
down vote
accepted
The self maintenance method is to vacuum the logs by size or time.
Retain only the past two days:
journalctl --vacuum-time=2d
Retain only the past 500 MB:
journalctl --vacuum-size=500M
man journalctl for more information.
answered Apr 2 '15 at 16:43
Michael
1,954162
The self maintenance method is to vacuum the logs by size or time.
Retain only the past two days:
journalctl --vacuum-time=2d
Retain only the past 500 MB:
journalctl --vacuum-size=500M
man journalctl for more information.
answered Apr 2 '15 at 16:43
Michael
1,954162
answered Apr 2 '15 at 16:43
Michael
1,954162
answered Apr 2 '15 at 16:43
Michael
1,954162
answered Apr 2 '15 at 16:43
Michael
1,954162
1,954162
9
Nice command, but didn't work for me on openSUSE 13.2 (the current stable release). It's known that Arch is usually at the cutting edge when it comes to kernel and userland programs, so I speculated that vacuum options might have been recently added to systemd and simply haven't precipitated down into my distro. Confirmed the fact here in Lennart's announcement on Dec 10 2014 techupdates.com/go/1002774 that this command was added in systemd v218. Just adding this comment incase any one else like me who is not on Arch has a similar issue. Upvoted anyway.
– Joshua Huber
Apr 23 '15 at 0:33
I just used 'journalctl --vacuum-time=1d' to fix a situation where new log messages weren't showing with 'journalctl -f'. Apparently my system time had temporarily jumped about a day forward for a while, then recovered, and journalctl was using the log event timestamps from that future time as the journal tail.
– user5071535
Nov 16 '15 at 18:23
7
Didn't work in version "systemd 229" on Ubuntu 16.04.journalctl --vacuum-size=1Kthenjournalctlstill shows way more than 1K. It shows all the messages since the last boot.
– Dan Dascalescu
Sep 10 '16 at 4:23
11
It seems that this only clears archived logs, not active ones. I tried runningjournalctl --flush --rotatebeforejournalctl --vacuum-time=1sand it removed more stuff, although still not everything.
– user60039
Feb 7 '17 at 19:42
1
The documentation doesn't seem so clear to me. Does it always stay set to 2d (in your example)? Or is 2d from the time you run the command? Maybe I'm not understanding how this works exactly.
– jersey bean
Aug 3 '17 at 1:49
 |Â
show 2 more comments
9
Nice command, but didn't work for me on openSUSE 13.2 (the current stable release). It's known that Arch is usually at the cutting edge when it comes to kernel and userland programs, so I speculated that vacuum options might have been recently added to systemd and simply haven't precipitated down into my distro. Confirmed the fact here in Lennart's announcement on Dec 10 2014 techupdates.com/go/1002774 that this command was added in systemd v218. Just adding this comment incase any one else like me who is not on Arch has a similar issue. Upvoted anyway.
– Joshua Huber
Apr 23 '15 at 0:33
I just used 'journalctl --vacuum-time=1d' to fix a situation where new log messages weren't showing with 'journalctl -f'. Apparently my system time had temporarily jumped about a day forward for a while, then recovered, and journalctl was using the log event timestamps from that future time as the journal tail.
– user5071535
Nov 16 '15 at 18:23
7
Didn't work in version "systemd 229" on Ubuntu 16.04.journalctl --vacuum-size=1Kthenjournalctlstill shows way more than 1K. It shows all the messages since the last boot.
– Dan Dascalescu
Sep 10 '16 at 4:23
11
It seems that this only clears archived logs, not active ones. I tried runningjournalctl --flush --rotatebeforejournalctl --vacuum-time=1sand it removed more stuff, although still not everything.
– user60039
Feb 7 '17 at 19:42
1
The documentation doesn't seem so clear to me. Does it always stay set to 2d (in your example)? Or is 2d from the time you run the command? Maybe I'm not understanding how this works exactly.
– jersey bean
Aug 3 '17 at 1:49
9
9
Nice command, but didn't work for me on openSUSE 13.2 (the current stable release). It's known that Arch is usually at the cutting edge when it comes to kernel and userland programs, so I speculated that vacuum options might have been recently added to systemd and simply haven't precipitated down into my distro. Confirmed the fact here in Lennart's announcement on Dec 10 2014 techupdates.com/go/1002774 that this command was added in systemd v218. Just adding this comment incase any one else like me who is not on Arch has a similar issue. Upvoted anyway.
– Joshua Huber
Apr 23 '15 at 0:33
Nice command, but didn't work for me on openSUSE 13.2 (the current stable release). It's known that Arch is usually at the cutting edge when it comes to kernel and userland programs, so I speculated that vacuum options might have been recently added to systemd and simply haven't precipitated down into my distro. Confirmed the fact here in Lennart's announcement on Dec 10 2014 techupdates.com/go/1002774 that this command was added in systemd v218. Just adding this comment incase any one else like me who is not on Arch has a similar issue. Upvoted anyway.
– Joshua Huber
Apr 23 '15 at 0:33
I just used 'journalctl --vacuum-time=1d' to fix a situation where new log messages weren't showing with 'journalctl -f'. Apparently my system time had temporarily jumped about a day forward for a while, then recovered, and journalctl was using the log event timestamps from that future time as the journal tail.
– user5071535
Nov 16 '15 at 18:23
I just used 'journalctl --vacuum-time=1d' to fix a situation where new log messages weren't showing with 'journalctl -f'. Apparently my system time had temporarily jumped about a day forward for a while, then recovered, and journalctl was using the log event timestamps from that future time as the journal tail.
– user5071535
Nov 16 '15 at 18:23
7
7
Didn't work in version "systemd 229" on Ubuntu 16.04.
journalctl --vacuum-size=1K then journalctl still shows way more than 1K. It shows all the messages since the last boot.– Dan Dascalescu
Sep 10 '16 at 4:23
Didn't work in version "systemd 229" on Ubuntu 16.04.
journalctl --vacuum-size=1K then journalctl still shows way more than 1K. It shows all the messages since the last boot.– Dan Dascalescu
Sep 10 '16 at 4:23
11
11
It seems that this only clears archived logs, not active ones. I tried running
journalctl --flush --rotate before journalctl --vacuum-time=1s and it removed more stuff, although still not everything.– user60039
Feb 7 '17 at 19:42
It seems that this only clears archived logs, not active ones. I tried running
journalctl --flush --rotate before journalctl --vacuum-time=1s and it removed more stuff, although still not everything.– user60039
Feb 7 '17 at 19:42
1
1
The documentation doesn't seem so clear to me. Does it always stay set to 2d (in your example)? Or is 2d from the time you run the command? Maybe I'm not understanding how this works exactly.
– jersey bean
Aug 3 '17 at 1:49
The documentation doesn't seem so clear to me. Does it always stay set to 2d (in your example)? Or is 2d from the time you run the command? Maybe I'm not understanding how this works exactly.
– jersey bean
Aug 3 '17 at 1:49
 |Â
show 2 more comments
up vote
50
down vote
You don't typically clear the journal yourself. That is managed by systemd itself and old logs are rotated out as new data comes in. The correct thing to do would be to schedule journald to only keep as much data as you are interested in. The most usual thing to adjust is the total disk space it is allowed to take up. Once it crosses this boundry it will start pitching old entries to stay near this value.
You can set this in /etc/systemd/journald.conf like so:
SystemMaxUse=100M
answered Jun 27 '14 at 11:52
Caleb
49.3k9146187
10
Ok, but there are also untypical situations. I know that most of them is just aesthetics as a reason, but aesthetics is a valid reason for human being ;) .
– ÅÂukasz Zaroda
Jun 27 '14 at 12:08
1
@Ã…ÂukaszZaroda In that case you are going to have to define "safe". Normally "I want to blow away something that a daemon is configured to keep" is incompatible with "safe". If you want to force it just shut down the service and zero out the log files. If you want it to work normally you should define the parameters in your question better. What do you mean by "safe"?
– Caleb
Jun 27 '14 at 12:17
By safe, I mean that after clearing it will work as usual, just starting from the new place.
– ÅÂukasz Zaroda
Jun 27 '14 at 12:19
5
It may be not typical situation but sometimes it is necessary to delete old logs due to some systemd's bugs, e.g. bbs.archlinux.org/viewtopic.php?pid=1173031#p1173031
– diffycat
Jun 27 '14 at 15:57
1
To clean logs after a period of time rather than when they reach a certain size, you can set the parameterMaxRetentionSecinstead ofSystemMaxUse. Seeman journald.conffor more details.
– joelostblom
Mar 29 at 13:08
 |Â
show 1 more comment
up vote
50
down vote
You don't typically clear the journal yourself. That is managed by systemd itself and old logs are rotated out as new data comes in. The correct thing to do would be to schedule journald to only keep as much data as you are interested in. The most usual thing to adjust is the total disk space it is allowed to take up. Once it crosses this boundry it will start pitching old entries to stay near this value.
You can set this in /etc/systemd/journald.conf like so:
SystemMaxUse=100M
answered Jun 27 '14 at 11:52
Caleb
49.3k9146187
10
Ok, but there are also untypical situations. I know that most of them is just aesthetics as a reason, but aesthetics is a valid reason for human being ;) .
– ÅÂukasz Zaroda
Jun 27 '14 at 12:08
1
@Ã…ÂukaszZaroda In that case you are going to have to define "safe". Normally "I want to blow away something that a daemon is configured to keep" is incompatible with "safe". If you want to force it just shut down the service and zero out the log files. If you want it to work normally you should define the parameters in your question better. What do you mean by "safe"?
– Caleb
Jun 27 '14 at 12:17
By safe, I mean that after clearing it will work as usual, just starting from the new place.
– ÅÂukasz Zaroda
Jun 27 '14 at 12:19
5
It may be not typical situation but sometimes it is necessary to delete old logs due to some systemd's bugs, e.g. bbs.archlinux.org/viewtopic.php?pid=1173031#p1173031
– diffycat
Jun 27 '14 at 15:57
1
To clean logs after a period of time rather than when they reach a certain size, you can set the parameterMaxRetentionSecinstead ofSystemMaxUse. Seeman journald.conffor more details.
– joelostblom
Mar 29 at 13:08
 |Â
show 1 more comment
up vote
50
down vote
up vote
50
down vote
You don't typically clear the journal yourself. That is managed by systemd itself and old logs are rotated out as new data comes in. The correct thing to do would be to schedule journald to only keep as much data as you are interested in. The most usual thing to adjust is the total disk space it is allowed to take up. Once it crosses this boundry it will start pitching old entries to stay near this value.
You can set this in /etc/systemd/journald.conf like so:
SystemMaxUse=100M
answered Jun 27 '14 at 11:52
Caleb
49.3k9146187
You don't typically clear the journal yourself. That is managed by systemd itself and old logs are rotated out as new data comes in. The correct thing to do would be to schedule journald to only keep as much data as you are interested in. The most usual thing to adjust is the total disk space it is allowed to take up. Once it crosses this boundry it will start pitching old entries to stay near this value.
You can set this in /etc/systemd/journald.conf like so:
SystemMaxUse=100M
answered Jun 27 '14 at 11:52
Caleb
49.3k9146187
edited Jun 27 '14 at 11:59
answered Jun 27 '14 at 11:52
Caleb
49.3k9146187
answered Jun 27 '14 at 11:52
Caleb
49.3k9146187
answered Jun 27 '14 at 11:52
Caleb
49.3k9146187
49.3k9146187
10
Ok, but there are also untypical situations. I know that most of them is just aesthetics as a reason, but aesthetics is a valid reason for human being ;) .
– ÅÂukasz Zaroda
Jun 27 '14 at 12:08
1
@Ã…ÂukaszZaroda In that case you are going to have to define "safe". Normally "I want to blow away something that a daemon is configured to keep" is incompatible with "safe". If you want to force it just shut down the service and zero out the log files. If you want it to work normally you should define the parameters in your question better. What do you mean by "safe"?
– Caleb
Jun 27 '14 at 12:17
By safe, I mean that after clearing it will work as usual, just starting from the new place.
– ÅÂukasz Zaroda
Jun 27 '14 at 12:19
5
It may be not typical situation but sometimes it is necessary to delete old logs due to some systemd's bugs, e.g. bbs.archlinux.org/viewtopic.php?pid=1173031#p1173031
– diffycat
Jun 27 '14 at 15:57
1
To clean logs after a period of time rather than when they reach a certain size, you can set the parameterMaxRetentionSecinstead ofSystemMaxUse. Seeman journald.conffor more details.
– joelostblom
Mar 29 at 13:08
 |Â
show 1 more comment
10
Ok, but there are also untypical situations. I know that most of them is just aesthetics as a reason, but aesthetics is a valid reason for human being ;) .
– ÅÂukasz Zaroda
Jun 27 '14 at 12:08
1
@Ã…ÂukaszZaroda In that case you are going to have to define "safe". Normally "I want to blow away something that a daemon is configured to keep" is incompatible with "safe". If you want to force it just shut down the service and zero out the log files. If you want it to work normally you should define the parameters in your question better. What do you mean by "safe"?
– Caleb
Jun 27 '14 at 12:17
By safe, I mean that after clearing it will work as usual, just starting from the new place.
– ÅÂukasz Zaroda
Jun 27 '14 at 12:19
5
It may be not typical situation but sometimes it is necessary to delete old logs due to some systemd's bugs, e.g. bbs.archlinux.org/viewtopic.php?pid=1173031#p1173031
– diffycat
Jun 27 '14 at 15:57
1
To clean logs after a period of time rather than when they reach a certain size, you can set the parameterMaxRetentionSecinstead ofSystemMaxUse. Seeman journald.conffor more details.
– joelostblom
Mar 29 at 13:08
10
10
Ok, but there are also untypical situations. I know that most of them is just aesthetics as a reason, but aesthetics is a valid reason for human being ;) .
– ÅÂukasz Zaroda
Jun 27 '14 at 12:08
Ok, but there are also untypical situations. I know that most of them is just aesthetics as a reason, but aesthetics is a valid reason for human being ;) .
– ÅÂukasz Zaroda
Jun 27 '14 at 12:08
1
1
@Ã…ÂukaszZaroda In that case you are going to have to define "safe". Normally "I want to blow away something that a daemon is configured to keep" is incompatible with "safe". If you want to force it just shut down the service and zero out the log files. If you want it to work normally you should define the parameters in your question better. What do you mean by "safe"?
– Caleb
Jun 27 '14 at 12:17
@Ã…ÂukaszZaroda In that case you are going to have to define "safe". Normally "I want to blow away something that a daemon is configured to keep" is incompatible with "safe". If you want to force it just shut down the service and zero out the log files. If you want it to work normally you should define the parameters in your question better. What do you mean by "safe"?
– Caleb
Jun 27 '14 at 12:17
By safe, I mean that after clearing it will work as usual, just starting from the new place.
– ÅÂukasz Zaroda
Jun 27 '14 at 12:19
By safe, I mean that after clearing it will work as usual, just starting from the new place.
– ÅÂukasz Zaroda
Jun 27 '14 at 12:19
5
5
It may be not typical situation but sometimes it is necessary to delete old logs due to some systemd's bugs, e.g. bbs.archlinux.org/viewtopic.php?pid=1173031#p1173031
– diffycat
Jun 27 '14 at 15:57
It may be not typical situation but sometimes it is necessary to delete old logs due to some systemd's bugs, e.g. bbs.archlinux.org/viewtopic.php?pid=1173031#p1173031
– diffycat
Jun 27 '14 at 15:57
1
1
To clean logs after a period of time rather than when they reach a certain size, you can set the parameter
MaxRetentionSec instead of SystemMaxUse. See man journald.conf for more details.– joelostblom
Mar 29 at 13:08
To clean logs after a period of time rather than when they reach a certain size, you can set the parameter
MaxRetentionSec instead of SystemMaxUse. See man journald.conf for more details.– joelostblom
Mar 29 at 13:08
 |Â
show 1 more comment
up vote
10
down vote
On Arch linux, the closest I got was:
- Edit /etc/systemd/journald.conf to set SystemMaxUse=1M
- Restarting journal:
sudo systemctl restart systemd-journald - Resetting SystemMaxUse=200M
- Re-Restarting the journal
On my system, each journal file is 8MB, and the above cleared all but 3, bringing the total size to ~25MB.
My use-case was disabling CoW for BTRFS (just for the journal directory and subdirectories): sudo chattr +C /var/log/journal/*. The problem is, the attribute is only set on newly-created files, thus the desire to flush the journal.
answered Feb 11 '15 at 23:53
helmingstay
11913
4
Your use-case was actually not needed. The point of disabling CoW on the journal is that it is frequently written to. That is not the case for the old rotated journal files, they just sit there.
– Hjulle
Mar 31 '15 at 10:03
I've setSystemMaxUse=1K, restartedsystemd-journald, but journalctl still shows entries I want gone. How is this progress from flat text files?
– Dan Dascalescu
Sep 10 '16 at 4:18
add a comment |Â
up vote
10
down vote
On Arch linux, the closest I got was:
- Edit /etc/systemd/journald.conf to set SystemMaxUse=1M
- Restarting journal:
sudo systemctl restart systemd-journald - Resetting SystemMaxUse=200M
- Re-Restarting the journal
On my system, each journal file is 8MB, and the above cleared all but 3, bringing the total size to ~25MB.
My use-case was disabling CoW for BTRFS (just for the journal directory and subdirectories): sudo chattr +C /var/log/journal/*. The problem is, the attribute is only set on newly-created files, thus the desire to flush the journal.
answered Feb 11 '15 at 23:53
helmingstay
11913
4
Your use-case was actually not needed. The point of disabling CoW on the journal is that it is frequently written to. That is not the case for the old rotated journal files, they just sit there.
– Hjulle
Mar 31 '15 at 10:03
I've setSystemMaxUse=1K, restartedsystemd-journald, but journalctl still shows entries I want gone. How is this progress from flat text files?
– Dan Dascalescu
Sep 10 '16 at 4:18
add a comment |Â
up vote
10
down vote
up vote
10
down vote
On Arch linux, the closest I got was:
- Edit /etc/systemd/journald.conf to set SystemMaxUse=1M
- Restarting journal:
sudo systemctl restart systemd-journald - Resetting SystemMaxUse=200M
- Re-Restarting the journal
On my system, each journal file is 8MB, and the above cleared all but 3, bringing the total size to ~25MB.
My use-case was disabling CoW for BTRFS (just for the journal directory and subdirectories): sudo chattr +C /var/log/journal/*. The problem is, the attribute is only set on newly-created files, thus the desire to flush the journal.
answered Feb 11 '15 at 23:53
helmingstay
11913
On Arch linux, the closest I got was:
- Edit /etc/systemd/journald.conf to set SystemMaxUse=1M
- Restarting journal:
sudo systemctl restart systemd-journald - Resetting SystemMaxUse=200M
- Re-Restarting the journal
On my system, each journal file is 8MB, and the above cleared all but 3, bringing the total size to ~25MB.
My use-case was disabling CoW for BTRFS (just for the journal directory and subdirectories): sudo chattr +C /var/log/journal/*. The problem is, the attribute is only set on newly-created files, thus the desire to flush the journal.
answered Feb 11 '15 at 23:53
helmingstay
11913
answered Feb 11 '15 at 23:53
helmingstay
11913
answered Feb 11 '15 at 23:53
helmingstay
11913
answered Feb 11 '15 at 23:53
helmingstay
11913
11913
4
Your use-case was actually not needed. The point of disabling CoW on the journal is that it is frequently written to. That is not the case for the old rotated journal files, they just sit there.
– Hjulle
Mar 31 '15 at 10:03
I've setSystemMaxUse=1K, restartedsystemd-journald, but journalctl still shows entries I want gone. How is this progress from flat text files?
– Dan Dascalescu
Sep 10 '16 at 4:18
add a comment |Â
4
Your use-case was actually not needed. The point of disabling CoW on the journal is that it is frequently written to. That is not the case for the old rotated journal files, they just sit there.
– Hjulle
Mar 31 '15 at 10:03
I've setSystemMaxUse=1K, restartedsystemd-journald, but journalctl still shows entries I want gone. How is this progress from flat text files?
– Dan Dascalescu
Sep 10 '16 at 4:18
4
4
Your use-case was actually not needed. The point of disabling CoW on the journal is that it is frequently written to. That is not the case for the old rotated journal files, they just sit there.
– Hjulle
Mar 31 '15 at 10:03
Your use-case was actually not needed. The point of disabling CoW on the journal is that it is frequently written to. That is not the case for the old rotated journal files, they just sit there.
– Hjulle
Mar 31 '15 at 10:03
I've set
SystemMaxUse=1K, restarted systemd-journald, but journalctl still shows entries I want gone. How is this progress from flat text files?– Dan Dascalescu
Sep 10 '16 at 4:18
I've set
SystemMaxUse=1K, restarted systemd-journald, but journalctl still shows entries I want gone. How is this progress from flat text files?– Dan Dascalescu
Sep 10 '16 at 4:18
add a comment |Â
up vote
10
down vote
A very brute force method to clean the entire log:
$ sudo journalctl --vacuum-time=1seconds
You can also use --vacuum-size as Michael mentoined.
answered Jul 6 '15 at 18:18
Lanti
28029
5
Didn't work. Entries for 15 minutes ago still show up, even after runningsystemctl restart systemd-journald.
– Dan Dascalescu
Sep 10 '16 at 4:15
1
Same here. This didn't work for me either. I'm running CentOS7.
– jersey bean
Aug 3 '17 at 1:55
add a comment |Â
up vote
10
down vote
A very brute force method to clean the entire log:
$ sudo journalctl --vacuum-time=1seconds
You can also use --vacuum-size as Michael mentoined.
answered Jul 6 '15 at 18:18
Lanti
28029
5
Didn't work. Entries for 15 minutes ago still show up, even after runningsystemctl restart systemd-journald.
– Dan Dascalescu
Sep 10 '16 at 4:15
1
Same here. This didn't work for me either. I'm running CentOS7.
– jersey bean
Aug 3 '17 at 1:55
add a comment |Â
up vote
10
down vote
up vote
10
down vote
A very brute force method to clean the entire log:
$ sudo journalctl --vacuum-time=1seconds
You can also use --vacuum-size as Michael mentoined.
answered Jul 6 '15 at 18:18
Lanti
28029
A very brute force method to clean the entire log:
$ sudo journalctl --vacuum-time=1seconds
You can also use --vacuum-size as Michael mentoined.
answered Jul 6 '15 at 18:18
Lanti
28029
answered Jul 6 '15 at 18:18
Lanti
28029
answered Jul 6 '15 at 18:18
Lanti
28029
answered Jul 6 '15 at 18:18
Lanti
28029
28029
5
Didn't work. Entries for 15 minutes ago still show up, even after runningsystemctl restart systemd-journald.
– Dan Dascalescu
Sep 10 '16 at 4:15
1
Same here. This didn't work for me either. I'm running CentOS7.
– jersey bean
Aug 3 '17 at 1:55
add a comment |Â
5
Didn't work. Entries for 15 minutes ago still show up, even after runningsystemctl restart systemd-journald.
– Dan Dascalescu
Sep 10 '16 at 4:15
1
Same here. This didn't work for me either. I'm running CentOS7.
– jersey bean
Aug 3 '17 at 1:55
5
5
Didn't work. Entries for 15 minutes ago still show up, even after running
systemctl restart systemd-journald.– Dan Dascalescu
Sep 10 '16 at 4:15
Didn't work. Entries for 15 minutes ago still show up, even after running
systemctl restart systemd-journald.– Dan Dascalescu
Sep 10 '16 at 4:15
1
1
Same here. This didn't work for me either. I'm running CentOS7.
– jersey bean
Aug 3 '17 at 1:55
Same here. This didn't work for me either. I'm running CentOS7.
– jersey bean
Aug 3 '17 at 1:55
add a comment |Â
up vote
6
down vote
Since --vacuum-time and --vacuum-size didn't do a thing for me I did the following:
$ find /var/log/journal -name "*.journal" | xargs sudo rm
$ sudo systemctl restart systemd-journald
It's not right, but it worked.
answered Dec 30 '16 at 22:08
Matt
20425
On Debian Jessie, the path is/run/log.
– Synchro
Feb 12 at 18:23
add a comment |Â
up vote
6
down vote
Since --vacuum-time and --vacuum-size didn't do a thing for me I did the following:
$ find /var/log/journal -name "*.journal" | xargs sudo rm
$ sudo systemctl restart systemd-journald
It's not right, but it worked.
answered Dec 30 '16 at 22:08
Matt
20425
On Debian Jessie, the path is/run/log.
– Synchro
Feb 12 at 18:23
add a comment |Â
up vote
6
down vote
up vote
6
down vote
Since --vacuum-time and --vacuum-size didn't do a thing for me I did the following:
$ find /var/log/journal -name "*.journal" | xargs sudo rm
$ sudo systemctl restart systemd-journald
It's not right, but it worked.
answered Dec 30 '16 at 22:08
Matt
20425
Since --vacuum-time and --vacuum-size didn't do a thing for me I did the following:
$ find /var/log/journal -name "*.journal" | xargs sudo rm
$ sudo systemctl restart systemd-journald
It's not right, but it worked.
answered Dec 30 '16 at 22:08
Matt
20425
answered Dec 30 '16 at 22:08
Matt
20425
answered Dec 30 '16 at 22:08
Matt
20425
answered Dec 30 '16 at 22:08
Matt
20425
20425
On Debian Jessie, the path is/run/log.
– Synchro
Feb 12 at 18:23
add a comment |Â
On Debian Jessie, the path is/run/log.
– Synchro
Feb 12 at 18:23
On Debian Jessie, the path is
/run/log.– Synchro
Feb 12 at 18:23
On Debian Jessie, the path is
/run/log.– Synchro
Feb 12 at 18:23
add a comment |Â
up vote
5
down vote
Michael's answer is missing one thing: vacuuming only removes archived journal files, not active ones. To get rid of everything, you need to rotate the files first so that recent entries are moved to inactive files.
So, the complete answer to remove all entries seems to be
journalctl --rotate
journalctl --vacuum-time=1s
(Note that you cannot combine this into one journalctl command.)
By the way, some distributions have journald configured so that it writes logs to disk (/var/log/journal) while others keep logs in memory (/run/log/journal). I expect that in some cases it may be necessary to use journalctl --flush first to get everything removed.
answered Jul 23 at 9:48
Jan Warchoł
353317
Yep, gotta rotate first. Thanks!
– math2001
Sep 9 at 4:16
journalctl: unrecognized option '--rotate'
– stiv
yesterday
add a comment |Â
up vote
5
down vote
Michael's answer is missing one thing: vacuuming only removes archived journal files, not active ones. To get rid of everything, you need to rotate the files first so that recent entries are moved to inactive files.
So, the complete answer to remove all entries seems to be
journalctl --rotate
journalctl --vacuum-time=1s
(Note that you cannot combine this into one journalctl command.)
By the way, some distributions have journald configured so that it writes logs to disk (/var/log/journal) while others keep logs in memory (/run/log/journal). I expect that in some cases it may be necessary to use journalctl --flush first to get everything removed.
answered Jul 23 at 9:48
Jan Warchoł
353317
Yep, gotta rotate first. Thanks!
– math2001
Sep 9 at 4:16
journalctl: unrecognized option '--rotate'
– stiv
yesterday
add a comment |Â
up vote
5
down vote
up vote
5
down vote
Michael's answer is missing one thing: vacuuming only removes archived journal files, not active ones. To get rid of everything, you need to rotate the files first so that recent entries are moved to inactive files.
So, the complete answer to remove all entries seems to be
journalctl --rotate
journalctl --vacuum-time=1s
(Note that you cannot combine this into one journalctl command.)
By the way, some distributions have journald configured so that it writes logs to disk (/var/log/journal) while others keep logs in memory (/run/log/journal). I expect that in some cases it may be necessary to use journalctl --flush first to get everything removed.
answered Jul 23 at 9:48
Jan Warchoł
353317
Michael's answer is missing one thing: vacuuming only removes archived journal files, not active ones. To get rid of everything, you need to rotate the files first so that recent entries are moved to inactive files.
So, the complete answer to remove all entries seems to be
journalctl --rotate
journalctl --vacuum-time=1s
(Note that you cannot combine this into one journalctl command.)
By the way, some distributions have journald configured so that it writes logs to disk (/var/log/journal) while others keep logs in memory (/run/log/journal). I expect that in some cases it may be necessary to use journalctl --flush first to get everything removed.
answered Jul 23 at 9:48
Jan Warchoł
353317
answered Jul 23 at 9:48
Jan Warchoł
353317
answered Jul 23 at 9:48
Jan Warchoł
353317
answered Jul 23 at 9:48
Jan Warchoł
353317
353317
Yep, gotta rotate first. Thanks!
– math2001
Sep 9 at 4:16
journalctl: unrecognized option '--rotate'
– stiv
yesterday
add a comment |Â
Yep, gotta rotate first. Thanks!
– math2001
Sep 9 at 4:16
journalctl: unrecognized option '--rotate'
– stiv
yesterday
Yep, gotta rotate first. Thanks!
– math2001
Sep 9 at 4:16
Yep, gotta rotate first. Thanks!
– math2001
Sep 9 at 4:16
journalctl: unrecognized option '--rotate'
– stiv
yesterday
journalctl: unrecognized option '--rotate'
– stiv
yesterday
add a comment |Â
up vote
0
down vote
journal-ctl -b-0 will show only from the most recent boot. You can also use -1, -2 etc. Your horrendous day is still there but you won't have to see it, unless you need to.
answered Jun 1 '15 at 11:11
David
91
add a comment |Â
up vote
0
down vote
journal-ctl -b-0 will show only from the most recent boot. You can also use -1, -2 etc. Your horrendous day is still there but you won't have to see it, unless you need to.
answered Jun 1 '15 at 11:11
David
91
add a comment |Â
up vote
0
down vote
up vote
0
down vote
journal-ctl -b-0 will show only from the most recent boot. You can also use -1, -2 etc. Your horrendous day is still there but you won't have to see it, unless you need to.
answered Jun 1 '15 at 11:11
David
91
journal-ctl -b-0 will show only from the most recent boot. You can also use -1, -2 etc. Your horrendous day is still there but you won't have to see it, unless you need to.
answered Jun 1 '15 at 11:11
David
91
answered Jun 1 '15 at 11:11
David
91
answered Jun 1 '15 at 11:11
David
91
answered Jun 1 '15 at 11:11
David
91
91
add a comment |Â
add a comment |Â
up vote
0
down vote
Both --rotate and --vacuum-time=1s didn't work for me on CentOS. I was able to clear it like this:
sudo rm -rf /run/log/journal/*
answered yesterday
stiv
1652414
add a comment |Â
up vote
0
down vote
Both --rotate and --vacuum-time=1s didn't work for me on CentOS. I was able to clear it like this:
sudo rm -rf /run/log/journal/*
answered yesterday
stiv
1652414
add a comment |Â
up vote
0
down vote
up vote
0
down vote
Both --rotate and --vacuum-time=1s didn't work for me on CentOS. I was able to clear it like this:
sudo rm -rf /run/log/journal/*
answered yesterday
stiv
1652414
Both --rotate and --vacuum-time=1s didn't work for me on CentOS. I was able to clear it like this:
sudo rm -rf /run/log/journal/*
answered yesterday
stiv
1652414
answered yesterday
stiv
1652414
answered yesterday
stiv
1652414
answered yesterday
stiv
1652414
1652414
add a comment |Â
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f139513%2fhow-to-clear-journalctl%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
