218

I couldn't find in google any safe way to clear systemd journal. Do anyone know any safe and reliable way to do so?

Let's say I was experimenting with something and my logs got cluttered with various error messages. Moreover I'm displaying my journal on my desktop by using Conky. I really don't want to see those errors as they remind me an awful day I was fixing this stuff, I want to feel like a fresh man after this horror. I think everyone will agree that this is a valid reason to clear the logs :P .

10 Answers 10

305

The self maintenance method is to vacuum the logs by size or time.

Retain only the past two days:

journalctl --vacuum-time=2d

Retain only the past 500 MB:

journalctl --vacuum-size=500M

man journalctl for more information.

  • 12
    Nice command, but didn't work for me on openSUSE 13.2 (the current stable release). It's known that Arch is usually at the cutting edge when it comes to kernel and userland programs, so I speculated that vacuum options might have been recently added to systemd and simply haven't precipitated down into my distro. Confirmed the fact here in Lennart's announcement on Dec 10 2014 techupdates.com/go/1002774 that this command was added in systemd v218. Just adding this comment incase any one else like me who is not on Arch has a similar issue. Upvoted anyway. – Joshua Huber Apr 23 '15 at 0:33
  • 8
    Didn't work in version "systemd 229" on Ubuntu 16.04. journalctl --vacuum-size=1K then journalctl still shows way more than 1K. It shows all the messages since the last boot. – Dan Dascalescu Sep 10 '16 at 4:23
  • 18
    It seems that this only clears archived logs, not active ones. I tried running journalctl --flush --rotate before journalctl --vacuum-time=1s and it removed more stuff, although still not everything. – user60039 Feb 7 '17 at 19:42
  • 2
    The documentation doesn't seem so clear to me. Does it always stay set to 2d (in your example)? Or is 2d from the time you run the command? Maybe I'm not understanding how this works exactly. – jersey bean Aug 3 '17 at 1:49
  • 1
    Careful though, I used sudo journalctl --vacuum-time=7d and was only left with logs from today... Seems like a buggy feature – EarthMind Apr 15 at 19:57
88

You don't typically clear the journal yourself. That is managed by systemd itself and old logs are rotated out as new data comes in. The correct thing to do would be to schedule journald to only keep as much data as you are interested in. The most usual thing to adjust is the total disk space it is allowed to take up. Once it crosses this boundry it will start pitching old entries to stay near this value.

You can set this in /etc/systemd/journald.conf like so:

SystemMaxUse=100M
  • 12
    Ok, but there are also untypical situations. I know that most of them is just aesthetics as a reason, but aesthetics is a valid reason for human being ;) . – Łukasz Zaroda Jun 27 '14 at 12:08
  • 2
    @ŁukaszZaroda In that case you are going to have to define "safe". Normally "I want to blow away something that a daemon is configured to keep" is incompatible with "safe". If you want to force it just shut down the service and zero out the log files. If you want it to work normally you should define the parameters in your question better. What do you mean by "safe"? – Caleb Jun 27 '14 at 12:17
  • 1
    By safe, I mean that after clearing it will work as usual, just starting from the new place. – Łukasz Zaroda Jun 27 '14 at 12:19
  • 5
    It may be not typical situation but sometimes it is necessary to delete old logs due to some systemd's bugs, e.g. bbs.archlinux.org/viewtopic.php?pid=1173031#p1173031 – diffycat Jun 27 '14 at 15:57
  • 1
    To clean logs after a period of time rather than when they reach a certain size, you can set the parameter MaxRetentionSec instead of SystemMaxUse. See man journald.conf for more details. – joelostblom Mar 29 '18 at 13:08
58

Michael's answer is missing one thing: vacuuming only removes archived journal files, not active ones. To get rid of everything, you need to rotate the files first so that recent entries are moved to inactive files.

So, the complete answer to remove all entries seems to be

journalctl --rotate
journalctl --vacuum-time=1s

(Note that you cannot combine this into one journalctl command.)

By the way, some distributions have journald configured so that it writes logs to disk (/var/log/journal) while others keep logs in memory (/run/log/journal). I expect that in some cases it may be necessary to use journalctl --flush first to get everything removed.

If you don't have --rotate in your version, you can use the --since argument to filter entries:

--since "2019-01-30 14:00:00"
--since today
  • journalctl: unrecognized option '--rotate' – stiv Oct 7 '18 at 12:22
  • 4
    while I get what the other answers are approaching (long term strategy) - the question is simple: how do you clear logs now (maybe you're not interested in the long term for your current task). This answers that question without making other assumptions and adds other great value to understanding journalctl. This should be the answer. – Marc Oct 20 '18 at 15:39
  • 2
    This was the only helpful answer for me. Thanks! – Freedo Sep 10 at 18:31
  • 2
    Original question was "how do I reset my logs for debugging purposes". This is the only answer that addresses that. And I'm really glad I found it. The rest are interesting journalctl factoids, but not answers to the questions. – Travis Griggs Oct 25 at 19:08
19

On Arch linux, the closest I got was:

  • Edit /etc/systemd/journald.conf to set SystemMaxUse=1M
  • Restarting journal: sudo systemctl restart systemd-journald
  • Resetting SystemMaxUse=200M
  • Re-Restarting the journal

On my system, each journal file is 8MB, and the above cleared all but 3, bringing the total size to ~25MB.

My use-case was disabling CoW for BTRFS (just for the journal directory and subdirectories): sudo chattr +C /var/log/journal/*. The problem is, the attribute is only set on newly-created files, thus the desire to flush the journal.

  • 4
    Your use-case was actually not needed. The point of disabling CoW on the journal is that it is frequently written to. That is not the case for the old rotated journal files, they just sit there. – Hjulle Mar 31 '15 at 10:03
  • 1
    I've set SystemMaxUse=1K, restarted systemd-journald, but journalctl still shows entries I want gone. How is this progress from flat text files? – Dan Dascalescu Sep 10 '16 at 4:18
13

Since --vacuum-time and --vacuum-size didn't do a thing for me I did the following:

$ sudo find /var/log/journal -name "*.journal" | xargs sudo rm 
$ sudo systemctl restart systemd-journald

It's not right, but it worked.

  • On Debian Jessie, the path is /run/log. – Synchro Feb 12 '18 at 18:23
  • 1
    only this helped me ! – T.Todua Nov 27 '18 at 10:49
  • This is the currently correct answer. It would be nice if the journalctl command could do this but it appears unable. – Kevin Lyda Sep 26 at 10:43
11

A very brute force method to clean the entire log:

$ sudo journalctl --vacuum-time=1seconds

You can also use --vacuum-size as Michael mentoined.

  • 5
    Didn't work. Entries for 15 minutes ago still show up, even after running systemctl restart systemd-journald. – Dan Dascalescu Sep 10 '16 at 4:15
  • 1
    Same here. This didn't work for me either. I'm running CentOS7. – jersey bean Aug 3 '17 at 1:55
5

Both --rotate and --vacuum-time=1s didn't work for me on CentOS. I was able to clear it like this:

sudo rm -rf /run/log/journal/*
  • I found 2 directories with hexadecimal name in ./journal. The journalctl commands only works in the most recent one. So I had to delete the old directory manually and that is safe. After I just limit the size in journal conf. – KeitelDOG Feb 19 at 20:40
1
  1. Back it up in case if you need it in future:
    cp /run/log/journal/<temp-string>/system.journal /mylog/dir/back/system.journal.bak

  2. Clear the file:
    cd /run/log/journal/<temp-string>/ >system.journal

  3. Check to see latest logs:
    journalctl -xe

1

journalctl -b will show only from the most recent boot. You can also use -b -1, -b -2 etc. Your horrendous day is still there but you won't have to see it, unless you need to.

1

My previous answer just got deleted for being "duplicated". Well, sorry for not being clear enough in my previous answer, but it was different from existing answers. So here's a more elaborated version:

journalctl -m --vacuum-time=1s did the trick for me. Please DO notice the -m flag, it merges all your journals and then clean them up. Without the -m flag, it didn't clean up anything in my case (on CentOS-7).

Hope it helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.