How to control the journal size for systemd in CentOS/RHEL 7 and 8

This post discusses how to control the journal size for systemd. The size limitations are governed by options in journald.conf. We can set the parameter ‘SystemMaxUse=512M’ and restart the service. Once done can verify the setting using the status option.

# egrep -v "^$|#" /etc/systemd/journald.conf
[Journal]
SystemMaxUse=512M
ForwardToSyslog=no

To restart the journald service:

# systemctl kill --kill-who=main --signal=SIGUSR2 systemd-journald.service
# systemctl status systemd-journald

To make systemd log to a different file other than syslog, the parameter “ForwardToSyslog=no” should be enabled under /etc/systemd/journald.conf and this would direct the entries to directory /var/log/journal

# ls -ld /var/log/journal
drwxr-sr-x+ 3 root systemd-journal 4096 Jan  2 23:28 /var/log/journal
[root@OL7 ~]# ls -lR /var/log/journal/
/var/log/journal/:
total 8
drwxr-sr-x+ 2 root systemd-journal 4096 Jan  9 21:31 542222f353a44d379f20a28fd53a4c1b

/var/log/journal/542222f353a44d379f20a28fd53a4c1b:
total 12292
-rw-r-----+ 1 root systemd-journal 4194304 Jan  9 19:12 system@ba00a91d2e984c1085c3c0f80e048949-000000000002b0fc-00059bb7dec75c99.journal
-rw-r-----+ 1 root systemd-journal 4194304 Jan  9 21:31 system@ba00a91d2e984c1085c3c0f80e048949-000000000002bac8-00059bb9c8b728e8.journal
-rw-r-----+ 1 root systemd-journal 4194304 Jan  9 22:11 system.journal

Example Scenario

Let’s see an example of the above settings:

1. Verify the size of journal before applying the settings:

# du -sh /var/log/journal/*
25M /var/log/journal/542222f353a44d379f20a28fd53a4c1b

2. Change the SystemMaxUse parameter to 30MB:

# egrep -v "^$|#" /etc/systemd/journald.conf
[Journal]
SystemMaxUse=30M
SystemMaxFileSize=30M
ForwardToSyslog=no

3. Restart the jounald service for the changes to take effect.

# systemctl kill --kill-who=main --signal=SIGUSR2 systemd-journald.service
# systemctl status systemd-journald
● systemd-journald.service - Journal Service
  Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static; vendor preset: disabled)
  Active: active (running) since Thu 2020-01-02 23:34:56 UTC; 5min ago
    Docs: man:systemd-journald.service(8)
      man:journald.conf(5)
Main PID: 11019 (systemd-journal)
  Status: "Processing requests..."
  Memory: 4.6M
  CGroup: /system.slice/systemd-journald.service
      └─11019 /usr/lib/systemd/systemd-journald

Jan 02 23:34:56 OL7 systemd-journal[11019]: Permanent journal is using 24.0M (max allowed 20.0M, trying to leave 1.5G free of 2.5G avail…it 24.0M).
Jan 02 23:34:56 OL7 systemd-journal[11019]: Journal started
Hint: Some lines were ellipsized, use -l to show in full.

Take reboot of the system if required.

# reboot -f

4. Verify the status of systemd-journald service again:

# systemctl status systemd-journald
● systemd-journald.service - Journal Service
  Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static; vendor preset: disabled)
  Active: active (running) since Thu 2020-01-02 23:41:25 UTC; 1min 7s ago
    Docs: man:systemd-journald.service(8)
      man:journald.conf(5)
Main PID: 442 (systemd-journal)
  Status: "Processing requests..."
  CGroup: /system.slice/systemd-journald.service
      └─442 /usr/lib/systemd/systemd-journald

Jan 02 23:41:25 OL7 systemd-journal[442]: Runtime journal is using 6.0M (max allowed 48.7M, trying to leave 73.0M free of 480.8M availab…it 48.7M).
Jan 02 23:41:25 OL7 systemd-journal[442]: Journal started
Jan 02 23:41:26 OL7 systemd-journal[442]: Permanent journal is using 32.0M (max allowed 60.0M, trying to leave 1.5G free of 2.5G availab…it 60.0M).
Jan 02 23:41:26 OL7 systemd-journal[442]: Time spent on flushing to /var is 14.583ms for 598 entries.
Hint: Some lines were ellipsized, use -l to show in full.

5. Verify that the size of journald is more than 25MB now.

# du -sh /var/log/journal/
33M /var/log/journal/

Purging the journal

We can also purge the file if they are too big and the server is production. We can either use command “–journalctl –vacuum-size=[XXX]M; where XXX is the number to be freed or option to free by time “–journalctl –vacuum-time=10d”.

# journalctl --vacuum-size=20M
  Deleted archived journal /var/log/journal/542222f353a44d379f20a28fd53a4c1b/system@3fd95a37dba142079fc5c999daec508e-000000000000652c-00059b2d42e185fd.journal (4.0M).
  Vacuuming done, freed 4.0M of archived journals on disk.
# du -sh /var/log/journal/
29M /var/log/journal/
# journalctl --vacuum-size=2M
Deleted archived journal /var/log/journal/542222f353a44d379f20a28fd53a4c1b/system@3fd95a37dba142079fc5c999daec508e-000000000006b759-00059b308b80682c.journal (4.0M).
Deleted archived journal /var/log/journal/542222f353a44d379f20a28fd53a4c1b/system@3fd95a37dba142079fc5c999daec508e-000000000006b7e6-00059b309fe61fac.journal (8.0M).
Deleted archived journal /var/log/journal/542222f353a44d379f20a28fd53a4c1b/[email protected]~ (8.0M).
Vacuuming done, freed 20.0M of archived journals on disk.
# du -sh /var/log/journal/
8.1M /var/log/journal/