Disk usage and vacuum by size/time

Show on-disk size, then prune to 500M and drop entries older than 2 days

journalctl --disk-usage; journalctl --vacuum-size=500M --vacuum-time=2d
tool
journalctl12 commands
tags
journalctldiskperformance

More journalctl commands

  • Follow logs by syslog identifier
    journalctl -t kernel -t sudo -f --no-hostname

    Tail by SYSLOG_IDENTIFIER (not unit); -t repeats, --no-hostname trims clutter

  • Project selected fields as columns
    journalctl -u <name> --output=json --output-fields=__REALTIME_TIMESTAMP,MESSAGE,_PID | jq -r '[.__REALTIME_TIMESTAMP,._PID,.MESSAGE]|@tsv'

    Trim JSON to needed fields then tab-format; __REALTIME_TIMESTAMP is microseconds

  • Merge journals from a directory
    journalctl -D /mnt/crashed/var/log/journal -b -1 -p err

    Read journals from another root (rescue/forensics) without copying files in

  • Verify persistent storage is enabled
    journalctl --header | grep -iE 'file|state'; ls -d /var/log/journal 2>/dev/null || echo volatile

    If /var/log/journal is absent, logs are volatile and lost on reboot. fix: mkdir + systemd-tmpfiles

  • Filter by priority error and above
    journalctl -p err -b --no-pager

    Only err/crit/alert/emerg from current boot; -p takes a range too (e.g. -p warning..err)

all 12 journalctl commands