660
Remember to not to forget clearing your journal (lemmy.world)
submitted 3 months ago by bali10050@lemmy.world to c/linuxmemes@lemmy.world
51 comments fedilink hide all child comments
top 50 comments
sorted by: hot top controversial new old
[-] morethanevil@lemmy.fedifriends.social 147 points 3 months ago

Cleanup

Check current disk usage:

sudo journalctl --disk-usage

Use rotate function:

sudo journalctl --rotate

Or

Remove all logs and keep the last 2 days:

sudo journalctl --vacuum-time=2days

Or

Remove all logs and only keep the last 100MB:

sudo journalctl --vacuum-size=100M

How to read logs:

Follow specific log for a service:

sudo journalctl -fu SERVICE

Show extended log info and print the last lines of a service:

sudo journalctl -xeu SERVICE

[-] DmMacniel@feddit.org 37 points 3 months ago

I mean yeah -fu stands for "follow unit" but its also a nice coincidence when it comes to debugging that particular service.

[-] morethanevil@lemmy.fedifriends.social 4 points 3 months ago

πŸ˜‚πŸ˜‚

[-] lseif@sopuli.xyz 23 points 3 months ago

--vacuum-time=2days

this implies i keep an operating system installed for that long

[-] jbk@discuss.tchncs.de 9 points 3 months ago

something something nix?

[-] slazer2au@lemmy.world 19 points 3 months ago

sudo journalctl --disk-usage

panda@Panda:~$ sudo journalctl --disk-usage  
No journal files were found.  
Archived and active journals take up 0B in the file system.

hmmmmmm........

[-] superkret@feddit.org 11 points 3 months ago* (last edited 3 months ago) 
user@u9310x-Slack:~$ sudo journalctl --disk-usage  
Password:  
sudo: journalctl: command not found
[-] DmMacniel@feddit.org 19 points 3 months ago* (last edited 3 months ago)

seems like someone doesn't like systemd :)

[-] superkret@feddit.org 5 points 3 months ago

I don't have any feelings towards particular init systems.

[-] Scipitie@lemmy.dbzer0.com 4 points 3 months ago

Just curious, what distro do you use that systemd is not the default? (I at least you didn't change it after the fact if you don't have any feelings (towards unit systems ;) ) )

[-] superkret@feddit.org 5 points 3 months ago

Slackware

[-] kralk@lemm.ee 8 points 3 months ago

Badass! Thanks!

[-] Tekkip20@lemmy.world 7 points 3 months ago

Thank you for this, wise sage.

Your wisdom will be passed down the family line for generations about managing machine logs.

[-] morethanevil@lemmy.fedifriends.social 4 points 3 months ago

Glad to help your family, share this wisdom with friends too β˜πŸ»πŸ˜ƒ

[-] VirtualOdour@sh.itjust.works 2 points 3 months ago

Yeah, if I had dependents they'd gather round the campfire chanting these mystical runes in the husk of our fallen society

[-] elxeno@lemm.ee 5 points 3 months ago

@RemindMe@programming.dev 6 months

[-] elxeno@lemm.ee 2 points 3 months ago

@ategon@programming.dev is the remindme bot offline?

[-] Ategon@programming.dev 3 points 3 months ago* (last edited 3 months ago)

Its semi broken currently and also functions on a whitelist with this community not being on the whitelist

load more comments (1 replies)
[-] Pacmanlives@lemmy.world 3 points 3 months ago

Actually something I never dug into. But does logrotate no longer work? I have a bunch of disk space these days so I would not notice large log files

[-] morethanevil@lemmy.fedifriends.social 2 points 3 months ago* (last edited 3 months ago)

If logrotate doesn't work, than use this as a cronjob via sudo crontab -e Put this line at the end of the file:

0 0 * * * journalctl --vacuum-size=1G >/dev/null 2>&1

Everyday the logs will be trimmed to 1GB. Usually the logs are trimmed automatically at 4GB, but sometimes this does not work

[-] fallingcats@discuss.tchncs.de 5 points 3 months ago

If we're using systemd already, why not a timer?

[-] morethanevil@lemmy.fedifriends.social 3 points 3 months ago

Cron is better known than a systemd timer, but you can provide an example for the timer πŸ˜ƒ

[-] fallingcats@discuss.tchncs.de 5 points 3 months ago* (last edited 3 months ago)

Really, the correct way would be to set the limit you want for journald. Put this into /etc/systemd/journald.conf.d/00-journal-size.conf:

[Journal]
SystemMaxUse=50M

Or something like this using a timer: systemd-run --timer-property=OnCalender=daily $COMMAND

[-] morethanevil@lemmy.fedifriends.social 3 points 3 months ago

Thanks for this addition ☺️

[-] MonkderVierte@lemmy.ml 2 points 3 months ago

Why isn't it configured like that by default?

[-] faerbit@sh.itjust.works 5 points 3 months ago

It is. The defaults are a little bit more lenient, but it shouldn't gobble up 80 GB of storage.

[-] morethanevil@lemmy.fedifriends.social 2 points 3 months ago

Good question, it may depend on the distro afaik

[-] rambling_lunatic@sh.itjust.works 2 points 3 months ago

If you use OpenRC you can just delete a couple files

[-] Andrew15_5@mander.xyz 34 points 3 months ago* (last edited 3 months ago)

*cough*80 GiB*cough*

[-] Ironfacebuster@lemmy.world 5 points 3 months ago

11.6 mega bites

[-] Andrew15_5@mander.xyz 5 points 3 months ago

Ah, yes, the standard burger size.

[-] RobotZap10000@feddit.nl 30 points 3 months ago

Try 60GB of system logs after 15 minutes of use. My old laptop's wifi card worked just fine, but spammed the error log with some corrected error. Adding pci=noaer to grub config fixed it.

[-] xilophor@lemmy.world 22 points 3 months ago

I had an issue on my PC (assuming faulty graphics driver or bug after waking from sleep) that caused my syslog file to reach 500GiB. Yes, 500GiB.

[-] possiblylinux127@lemmy.zip 29 points 3 months ago

You just need a bigger drive. Don't delete anything

[-] b00m@lemmy.world 10 points 3 months ago

Oh lord watch me hoard

[-] wildbus8979@sh.itjust.works 26 points 3 months ago* (last edited 3 months ago)

Fucking blows my mind that journald broke what is essentially the default behavior of every distro's use of logrotate and no one bats an eye.

[-] Regalia 26 points 3 months ago* (last edited 3 months ago)

I'm not sure if you're joking or not, but the behavior of journald is fairly dynamic and can be configured to an obnoxious degree, including compression and sealing.

By default, the size limit is 4GB:

SystemMaxUse= and RuntimeMaxUse= control how much disk space the journal may use up at most. SystemKeepFree= and RuntimeKeepFree= control how much disk space systemd-journald shall leave free for other uses. systemd-journald will respect both limits and use the smaller of the two values.

The first pair defaults to 10% and the second to 15% of the size of the respective file system, but each value is capped to 4G.

[-] Max_P@lemmy.max-p.me 12 points 3 months ago

If anything I tend to have the opposite problem: whoops I forgot to set up logrotate for this log file I set up 6 months ago and now my disk is completely full. Never happens for stuff that goes to journald.

[-] wildbus8979@sh.itjust.works 5 points 3 months ago* (last edited 3 months ago)

It can be, but the defaults are freaking stupid and often do not work.

[-] Starbuck@lemmy.world 18 points 3 months ago

Aren’t the defaults set by your distro?

[-] wildbus8979@sh.itjust.works 2 points 3 months ago

AAfaict Debian uses the upstream defaults.

[-] hushable@lemmy.world 25 points 3 months ago* (last edited 3 months ago)

Once I had a mission critical service crash because the disk got full, turns out there was a typo on the logrotate config and as a result the logs were not being cleaned up at all.

edit: I should add that I used the commands shared in this post to free up space and bring the service back up

[-] muhyb@programming.dev 15 points 3 months ago

This once happened to me on my pi-hole. It's an old netbook with 250 GB HDD. Pi-hole stopped working and I checked the netbook. There was a 242 GB log file. :)

[-] SuperIce@lemmy.world 11 points 3 months ago

Systems/Journald keeps 4GB of logs stored by default.

[-] Muscar@discuss.online 10 points 3 months ago

Title gore

[-] snugglebutt 10 points 3 months ago

Recently had the jellyfin log directory take up 200GB, checked the forums and saw someone with the same problem but 1TB instead.

[-] Agent641@lemmy.world 16 points 3 months ago* (last edited 3 months ago)

2024-03-28 16:37:12:017 - Everythings fine

2024-03-28 16:37:12:016 - Everythings fine

2024-03-28 16:37:12:015 - Everythings fine

[-] MonkderVierte@lemmy.ml 7 points 3 months ago* (last edited 3 months ago)

logrotate is a thing.

[-] alien@lemm.ee 5 points 3 months ago

I couldn't tell for a solid minute if the title was telling me to clear the journal or not

[-] Scribbd@feddit.nl 5 points 3 months ago

I recently discovered the company I work for, has an S3 bucket with network flow logs of several TB. It contains all network activity if the past 8 years.

Not because we needed it. No, the lifecycle policy wasn't configured correctly.

load more comments
view more: next β€Ί
this post was submitted on 01 Aug 2024
660 points (100.0% liked)

linuxmemes

21189 readers
668 users here now

Hint: :q!

Sister communities:

Community rules (click to expand)

1. Follow the site-wide rules

2. Be civil
  • Understand the difference between a joke and an insult.
  • Do not harrass or attack members of the community for any reason.
  • Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.
  • Bigotry will not be tolerated.
  • These rules are somewhat loosened when the subject is a public figure. Still, do not attack their person or incite harrassment.
    • 3. Post Linux-related content
  • Including Unix and BSD.
  • Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of sudo in Windows.
  • No porn. Even if you watch it on a Linux machine.
    • 4. No recent reposts
  • Everybody uses Arch btw, can't quit Vim, and wants to interject for a moment. You can stop now.

    • Please report posts and comments that break these rules!

    founded 1 year ago
    MODERATORS
    poopsmith@lemmy.world
    zephyr@lemmy.world
    rtxn@lemmy.world