Optimize Linux disk space via journalctl

Introduction

As a system administrator, managing logs is an important part of maintaining the health and performance of your Linux servers. One of the main logging systems in modern Linux distributions is the systemd logging subsystem, journactl. Over time, logs can accumulate and consume a significant amount of disk space, which can lead to problems if the disk fills up. In this tutorial, we will cover how to optimize journalctl to save server disk space while ensuring that necessary log information is retained for troubleshooting and auditing purposes.

Introduction to Journalctl and Systemd Journaling

Before we dive into optimization, it is important to have a basic understanding of journalctl and systemd journaling. Systemd journaling is a log pair that stores log data in a structured and indexed format. journalctl is the code and commands used to interact with the journal.

The logs in the systemd log are persistent across reboots by default and can grow indefinitely without proper configuration. This is where optimization comes into play.

Step 1 – Assess current disk usage by journal reports

To start, let's assess what space magazine reports currently use:

journalctl --disk-usage

This command will tell you the total amount of disk space consumed by journal reports.

Archived and active journals take up 3.5G in the file system.

systemd journal is configured via a file /etc/systemd/journald.conf. To optimize disk usage, you need to edit this file.

sudo nano /etc/systemd/journald.conf

Here are the key settings you should consider:

• SystemMaxUse: This sets the maximum space that logs can use on disk. Once this limit is reached, older logs are deleted to make room for new ones.
• SystemKeepFree: This ensures that systemd always leaves a certain amount of free space on the disk.
• MaxRetentionSec: This sets the maximum time to store log entries. Entries older than this time will be deleted.
• MaxFileSec: This sets the maximum time before a new journal file is started.

Configure these settings based on the size of your server's disk and the amount of log information you need to keep. For example:

SystemMaxUse=500M
SystemKeepFree=1G
MaxRetentionSec=1month
MaxFileSec=1week

These settings limit logs to 500 MB, ensure that at least 1 GB of disk space is always free, keep logs for up to one month, and start a new log file every week.

After editing the file, save your changes and restart the service:systemd-journald particle for direct object Launch .

sudo systemctl restart systemd-journald

Step 3 – Manual Journal Cutting

If you need to immediately reduce disk space usage, you can manually truncate the journal. To delete entries older than a certain time, use the following code:

sudo journalctl --vacuum-time=1month

To limit the journal size to a specific size, use the code:

sudo journalctl --vacuum-size=500M

These commands remove older entries to respect the time interval or size limit you set.

Step 4 – Set Log Rotation

While systemd-journald It performs its report rotation based on the configuration file (config), if you use other reporting systems alongside systemd-journald You can also set additional report rotations. For example, logrotate It is a tool that rotates, compresses, and emails system logs. You can configure it by editing its configuration files in /etc/logrotate.conf and /etc/logrotate.d logrotate Configure.

Conclusion

Optimization journalctl A key step in managing your Linux server's disk space is configuring systemd-journaldBy manually truncating logs, setting up log rotation, and monitoring disk usage, you can ensure that your server is running efficiently without running out of disk space due to bloated log files. Remember to balance the need for disk space with the need for sufficient log data for analysis and troubleshooting. Regularly reviewing and adjusting your logging configuration will help you maintain optimal settings.