I notice that the output of journalctl is enormous - currently 326963 lines - which makes it somewhat unwieldy.
This is because it reaches back more than a month, and contains everything from cronjobs (a whole 16 lines for every job run) to SUSEfirewall complaints about my FRITZ!Box router poking port 80.
In the olden pre-systemd times, I had configured logrotate to automatically start new syslog files in regular intervals, renaming and compressing the old ones in case I would still want to consult them later, and dropping the oldest ones so that my disk space would not be exhausted.
Is there an equivalent for journald?
The journal is already compressed, you can use
journalctl -xn
where “n” is the number of lines. Also see ‘man journalctl’ for other filtering options.
Of course you could step away and revert to syslog etc, but my advice would be to get acquainted with journalctl and it’s various options.
It’s possible to configure the journalling behaviour to your liking by tuning various parameters in /etc/systemd/journald.conf
These references may also be helpful to you…
https://www.freedesktop.org/software/systemd/man/journalctl.html
https://wiki.archlinux.org/index.php/Systemd#Journal_size_limit
and of course
man journald.conf
Doesn’t seem to work:
ts@xenon:~/System> LANG=C sudo journalctl -x20
journalctl: invalid option -- '2'
ts@xenon:~/System> LANG=C sudo journalctl -x 20
Failed to add match '20': Invalid argument
“man journalctl” says -x will “add explanatory help texts to log messages in the output where this is available” and doesn’t accept an argument.
Did you perhaps mean a different option?
Thanks. So it seems that before I can adapt any of this I have to set the Storage option in journald.conf to “persistent”, otherwise it will always store all of the entries since the last boot until the next boot. Once I’ve set that I can then use the MaxFileSec option to switch journal files at regular intervals, and SystemMaxFiles to limit the number of files kept. Is that correct?
For the record, I’m running with the default settings so far which according to the manpage means “Storage=auto” which in turn means volatile storage as the directory /var/log/journal does not exist.
There are different tunables for persistent and run-time journal files.