342

I use Fedora and these directories contains a large amount of files, I wonder whether I can delete them? The system is running low on space.

Improve this question

3 Answers 3

Reset to default
471

journal logs

Yes you can delete everything inside of /var/log/journal/* but do not delete the directory itself. You can also query journalctl to find out how much disk space it's consuming:

$ journalctl --disk-usage
Journals take up 3.8G on disk.

You can control the size of this directory using this parameter in your /etc/systemd/journald.conf:

SystemMaxUse=50M

You can force a log rotation:

$ sudo systemctl kill --kill-who=main --signal=SIGUSR2 systemd-journald.service

NOTE: You might need to restart the logging service to force a log rotation, if the above signaling method does not do it. You can restart the service like so:

$ sudo systemctl restart systemd-journald.service

abrt logs

These files too under /var/cache/abrt-di/* can be deleted as well. The size of the log files here is controlled under:

$ grep -i size /etc/abrt/abrt.conf 
# Max size for crash storage [MiB] or 0 for unlimited
MaxCrashReportsSize = 1000

You can control the max size of /var/cache/abrt-di by changing the following in file, /etc/abrt/plugins/CCpp.conf:

DebugInfoCacheMB = 2000

NOTE: If not defined DebugInfoCacheMB defaults to 4000 (4GB).

References

Improve this answer
8
  • 4
    Same here, systemctl restart systemd-journald.service forced the rotate and not signaling the process
    – Michael Ben-Nes
    Commented May 9, 2015 at 8:24
  • 2
    @michaelbn - the signalling has/had worked for me in the past. I haven't had to do this that often though, so I've incorporated the restart method into the answer as well in case other readers have that same issue as you.
    – slm ♦
    Commented May 9, 2015 at 12:56
  • 3
    To clean logs after a period of time rather than when they reach a certain size, you can set the parameter MaxRetentionSec instead of SystemMaxUse. See man journald.conf for more details.
    – joelostblom
    Commented Mar 29, 2018 at 13:08
  • 2
    The about said journalctl solution even works in ubuntu 18
    – Aravind
    Commented May 17, 2019 at 4:51
  • On my system (Ubuntu 16.04 LTS), SystemMaxUse=1024MB appears in /etc/systemd/journald.conf and is un-commented, but journalctl --disk-usage reports Archived and active journals take up 4.0G on disk. Am I missing something?
    – Ben Johnson
    Commented Feb 11, 2020 at 2:55
295

Yes, the files from /var/log/journal directory can be removed.

The nicest method I've found is:

sudo journalctl --vacuum-size=500M

which deletes old log-files from /var/log/journal until total size of the directory becomes under specified threshold (500 megabytes in this example).

Improve this answer
5
  • 5
    safe, fast, smooth and clean, thanks! also, as mentioned in unix.stackexchange.com/a/130802/142247 there is a permanent solution for this in /etc/systemd/journald.conf -> SystemMaxUse=500M
    – crysman
    Commented Apr 5, 2020 at 10:48
  • 14
    Make it permanent with: echo SystemMaxUse=500M | sudo tee -a /etc/systemd/journald.conf
    – Rael Gugelmin Cunha
    Commented Jul 16, 2020 at 13:58
  • 4
    I had to use sudo otherwise it clears 0 bytes sudo journalctl --vacuum-size=500M
    – Nickson Yap
    Commented Oct 20, 2020 at 4:36
  • 4
    What is the use of keeping it so large by default? Do we lose anything by trimming to 500MB? Will we lose the ability to recover data in the event of crash if we keep it low?
    – Jus12
    Commented Mar 16, 2021 at 7:18
  • @Jus12 it depends on workload on machine. If you have a lot of software and a lot of logs - you will definitely loose some logs for the past periods. Maybe the next answer (--vacuum-time) can help to explain what I mean.
    – void
    Commented May 21 at 12:13
81

You can also clean based on time: journalctl --vacuum-time=10d

# du -sh /var/log/journal
113M    /var/log/journal
# journalctl --vacuum-time=10d
Deleted archived journal /var/log/journal/f77f9567bb70f8e7b5d9a0c95bef5c2a/system@36170b4530af4c89ac4d84ac68f8b727-0000000000000001-00057b09da23eb2c.journal (8.0M).
Deleted archived journal /var/log/journal/f77f9567bb70f8e7b5d9a0c95bef5c2a/user-1000@54176301a0c74c4698c3b6a549e1b2ed-0000000000000874-00057b0c1a491094.journal (8.0M).
. . .
Deleted archived journal /var/log/journal/f77f9567bb70f8e7b5d9a0c95bef5c2a/user-1000@e6ecd2f858d1498b9a445af7bac00bbf-000000000000063a-0005848ac99802b3.journal (8.0M).
Vacuuming done, freed 88.0M of archived journals from /var/log/journal/f77f9567bb70f8e7b5d9a0c95bef5c2a.
root@monroe:/var/log# du -sh /var/log/journal     
25M     /var/log/journal
Improve this answer
1
  • 3
    that command worked. ncdu revealed that journal logs were taking lots of space. i just cleared about 3.8GB of space on my ssd. really needed some free space.
    – Prashant Pugalia
    Commented Apr 25, 2021 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .