mjhjmtu

I couldn't find in google any safe way to clear systemd journal. Do anyone know any safe and reliable way to do so?

Let's say I was experimenting with something and my logs got cluttered with various error messages. Moreover I'm displaying my journal on my desktop by using Conky. I really don't want to see those errors as they remind me an awful day I was fixing this stuff, I want to feel like a fresh man after this horror. I think everyone will agree that this is a valid reason to clear the logs :P .

The self maintenance method is to vacuum the logs by size or time.

Retain only the past two days:

journalctl --vacuum-time=2d

Retain only the past 500 MB:

journalctl --vacuum-size=500M

man journalctl for more information.

You don't typically clear the journal yourself. That is managed by systemd itself and old logs are rotated out as new data comes in. The correct thing to do would be to schedule journald to only keep as much data as you are interested in. The most usual thing to adjust is the total disk space it is allowed to take up. Once it crosses this boundry it will start pitching old entries to stay near this value.

You can set this in /etc/systemd/journald.conf like so:

SystemMaxUse=100M

On Arch linux, the closest I got was:

• Edit /etc/systemd/journald.conf to set SystemMaxUse=1M


• Restarting journal: sudo systemctl restart systemd-journald
  


• Resetting SystemMaxUse=200M


• Re-Restarting the journal

On my system, each journal file is 8MB, and the above cleared all but 3, bringing the total size to ~25MB.

My use-case was disabling CoW for BTRFS (just for the journal directory and subdirectories): sudo chattr +C /var/log/journal/*. The problem is, the attribute is only set on newly-created files, thus the desire to flush the journal.

A very brute force method to clean the entire log:

$ sudo journalctl --vacuum-time=1seconds

You can also use --vacuum-size as Michael mentoined.

Since --vacuum-time and --vacuum-size didn't do a thing for me I did the following:

$ find /var/log/journal -name "*.journal" | xargs sudo rm
$ sudo systemctl restart systemd-journald

It's not right, but it worked.

Michael's answer is missing one thing: vacuuming only removes archived journal files, not active ones. To get rid of everything, you need to rotate the files first so that recent entries are moved to inactive files.

So, the complete answer to remove all entries seems to be

journalctl --rotate
journalctl --vacuum-time=1s

(Note that you cannot combine this into one journalctl command.)

By the way, some distributions have journald configured so that it writes logs to disk (/var/log/journal) while others keep logs in memory (/run/log/journal). I expect that in some cases it may be necessary to use journalctl --flush first to get everything removed.