2

I'm running Ubuntu 20.04 on a server. Currently my /var/log/journal folder grows rapidly (about 1Gb in a week) and I don't understand why.

If I check the logs with journalctl I cannot see any major problem, just a lot of SSH connections, which is fine.

I tried looking at a specific journal file with journalctl --file and it only showed like 14 log lines, but the file has 8MB, so there must be something hidden within this file. I also tried the --all flag, but that didn't change anything.

I'm not very familiar with the journal, can someone tell me what I'm missing?

0

If scrolling through journalctl mostly shows ssh connections, then that's probably is what is filling up your journal.

Here are a couple of things you can do:

  1. Temporarily stop logging from that unit.
sudo systemctl edit sshd.service

In this fille add:

[System]
StandardOutput=null

You could also use StandardOutput=file:path/to/file if you want to save those logs for audit or review while you are doing your test. Leave this for a week and see if your journal continues to grow and a crazy rate. When you are done your test, systemctl edit sshd.service your changes away.

  1. Set limits on the size of the journal. If you are concerned about the journal dominating disk-space, you can set limits with journald.conf. Something like this might help:
# /etc/systemd/journal.conf.d/maxsize.conf
[Journal]
SystemMaxUse=1G

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.