Evaluate systemd logs using journalctl
Finely Filtered
![© Lead Image © Juergen Priewe, 123RF.com © Lead Image © Juergen Priewe, 123RF.com](/var/linux_magazin/storage/images/issues/2017/201/journalctl/123rf_20287042_sort-spheres_juergenpriewe_resized.png/708295-1-eng-US/123RF_20287042_Sort-Spheres_JuergenPriewe_resized.png1_medium.png)
© Lead Image © Juergen Priewe, 123RF.com
The journal is the systemd component responsible for viewing and managing logfiles.
The systemd service journald creates very comprehensive logs, which allow you to analyze data in a variety of ways. Once you get used to the convenience this affords, you won't even miss the old-style logfiles.
Better structured
The journald daemon collects messages from the kernel, initrd, any running services and other available sources and collects them into one place. This results in a massive amount of data compared to the logfiles you're traditionally used to such as /var/log/messages or /var/log/syslog. You'll also find a huge amount of metadata is included, which can significantly improve your results when searching the journal.
This also results in a larger amount of data which is tricky to store in traditional text files. This is why the journald daemon stores this information in binary files. You can read this data, using the command journalctl
. If necessary, you can also convert the binary files to other formats for further analysis.
A little off the top
The huge amount of data being logged results in large files. While your system previously managed to trim these down using the Logrotate tool to compress and archive logfiles, the systemd journal allows you to set limits when files are changed.
Take a look at your own systemd [1] configuration file. For non-Debian based Linux distros, this is usually found in /etc/systemd/journald.conf
. You may also find it in /etc/systemd/journald.conf
. Look for the values SystemMaxUse
and SystemKeepFree
. The first of these determines how much space the journal files contain. The second value specifies how much free space to allocate (Figure 1).
![](/var/linux_magazin/storage/images/issues/2017/201/journalctl/figure-1/708298-1-eng-US/Figure-11_large.png)
Both values will determine the absolute limit on journal file sizes and available space. If you don't enter any values, the default amount of space permitted for journal files is 10 percent of your filesystem. The minimum amount of free space is 15 percent by default. The program caps both values at 4 GB for each.
Given the size of hard drives nowadays, it's perfectly feasible to set SystemMaxUse
to somewhere between 50 MB to 1 GB. In any case, the default values for the journal are sufficient for everyday use. Feel free to change the SystemMaxFileSize
to limit the size of individual files if you think it's necessary, however.
When setting size limits, use the values K
,G
and T
for kilobytes, gigabytes and terabytes respectively. If you want to alter the default values in journald.conf
, make sure to uncomment each line by removing the #
at the start, then restart the journald daemon.
Persistent or volatile?
Take a look at the line reading Storage=. While most Linux distributions are configured to store logs continuously, your logs will only be saved to var/log/journal
if you set this to Storage=persistent
. If you don't want to save the logs, change this to Storage=volatile
instead. Doing this means your logs will be stored in /run/log/journal
but will be deleted by the daemon once your active session ends.
For more options for controlling the journal size, pull up the man page for journald.conf
. If you want to reduce the journal size while it's running, you have two choices. Your first choice is to use the following command to reduce journal size, for instance to 100 MB. While running as root, enter:
# journalctl --vacuum-size=100M
The program will delete the oldest entries until the journal reaches the desired size (in this case 100 MB). Your second option is to remove all entries before a certain time:
# journalctl --vacuum-time=1month
The above command discards all messages older than one month (Figure 2), irrespective of how large or small this would make the logfile.
![](/var/linux_magazin/storage/images/issues/2017/201/journalctl/figure-2/708301-1-eng-US/Figure-21_large.png)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
![Learn More](https://www.linux-magazine.com/var/linux_magazin/storage/images/media/linux-magazine-eng-us/images/misc/learn-more/834592-1-eng-US/Learn-More_medium.png)
News
-
NVIDIA Released Driver for Upcoming NVIDIA 560 GPU for Linux
Not only has NVIDIA released the driver for its upcoming CPU series, it's the first release that defaults to using open-source GPU kernel modules.
-
OpenMandriva Lx 24.07 Released
If you’re into rolling release Linux distributions, OpenMandriva ROME has a new snapshot with a new kernel.
-
Kernel 6.10 Available for General Usage
Linus Torvalds has released the 6.10 kernel and it includes significant performance increases for Intel Core hybrid systems and more.
-
TUXEDO Computers Releases InfinityBook Pro 14 Gen9 Laptop
Sporting either AMD or Intel CPUs, the TUXEDO InfinityBook Pro 14 is an extremely compact, lightweight, sturdy powerhouse.
-
Google Extends Support for Linux Kernels Used for Android
Because the LTS Linux kernel releases are so important to Android, Google has decided to extend the support period beyond that offered by the kernel development team.
-
Linux Mint 22 Stable Delayed
If you're anxious about getting your hands on the stable release of Linux Mint 22, it looks as if you're going to have to wait a bit longer.
-
Nitrux 3.5.1 Available for Install
The latest version of the immutable, systemd-free distribution includes an updated kernel and NVIDIA driver.
-
Debian 12.6 Released with Plenty of Bug Fixes and Updates
The sixth update to Debian "Bookworm" is all about security mitigations and making adjustments for some "serious problems."
-
Canonical Offers 12-Year LTS for Open Source Docker Images
Canonical is expanding its LTS offering to reach beyond the DEB packages with a new distro-less Docker image.
-
Plasma Desktop 6.1 Released with Several Enhancements
If you're a fan of Plasma Desktop, you should be excited about this new point release.