331

I use Fedora and these directories contains a large amount of files, I wonder whether I can delete them? The system is running low on space.

slm
  • 369,824
hgajshb
  • 3,865
  • 4
  • 19
  • 18

3 Answers3

450

journal logs

Yes you can delete everything inside of /var/log/journal/* but do not delete the directory itself. You can also query journalctl to find out how much disk space it's consuming:

$ journalctl --disk-usage
Journals take up 3.8G on disk.

You can control the size of this directory using this parameter in your /etc/systemd/journald.conf:

SystemMaxUse=50M

You can force a log rotation:

$ sudo systemctl kill --kill-who=main --signal=SIGUSR2 systemd-journald.service

NOTE: You might need to restart the logging service to force a log rotation, if the above signaling method does not do it. You can restart the service like so:

$ sudo systemctl restart systemd-journald.service

abrt logs

These files too under /var/cache/abrt-di/* can be deleted as well. The size of the log files here is controlled under:

$ grep -i size /etc/abrt/abrt.conf 
# Max size for crash storage [MiB] or 0 for unlimited
MaxCrashReportsSize = 1000

You can control the max size of /var/cache/abrt-di by changing the following in file, /etc/abrt/plugins/CCpp.conf:

DebugInfoCacheMB = 2000

NOTE: If not defined DebugInfoCacheMB defaults to 4000 (4GB).

References

slm
  • 369,824
  • 4
    Same here, systemctl restart systemd-journald.service forced the rotate and not signaling the process – Michael Ben-Nes May 09 '15 at 08:24
  • 2
    @michaelbn - the signalling has/had worked for me in the past. I haven't had to do this that often though, so I've incorporated the restart method into the answer as well in case other readers have that same issue as you. – slm May 09 '15 at 12:56
  • 3
    To clean logs after a period of time rather than when they reach a certain size, you can set the parameter MaxRetentionSec instead of SystemMaxUse. See man journald.conf for more details. – joelostblom Mar 29 '18 at 13:08
  • 2
    The about said journalctl solution even works in ubuntu 18 – Aravind May 17 '19 at 04:51
  • On my system (Ubuntu 16.04 LTS), SystemMaxUse=1024MB appears in /etc/systemd/journald.conf and is un-commented, but journalctl --disk-usage reports Archived and active journals take up 4.0G on disk. Am I missing something? – Ben Johnson Feb 11 '20 at 02:55
  • @BenJohnson might be this bug - https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1790205 – slm Feb 11 '20 at 03:05
  • Will 50M be enough for journal? – alper Apr 09 '23 at 12:39
  • I couldn't get it to trigger a rotate using either method, but the vacuum proposed in another answer worked. I'll see if it continues to get bigger than the SystemMaxUse I set. (Previously it was unset, and there were 3.9GB of logs—essentially in line with the default cap.) – Jonathan W. Nov 12 '23 at 20:41
279

Yes, the files from /var/log/journal directory can be removed.

The nicest method I've found is:

sudo journalctl --vacuum-size=500M

which deletes old log-files from /var/log/journal until total size of the directory becomes under specified threshold (500 megabytes in this example).

Hugolpz
  • 163
  • 1
  • 5
Sysadmin
  • 2,891
  • 4
    safe, fast, smooth and clean, thanks! also, as mentioned in https://unix.stackexchange.com/a/130802/142247 there is a permanent solution for this in /etc/systemd/journald.conf -> SystemMaxUse=500M – crysman Apr 05 '20 at 10:48
  • 12
    Make it permanent with: echo SystemMaxUse=500M | sudo tee -a /etc/systemd/journald.conf – Rael Gugelmin Cunha Jul 16 '20 at 13:58
  • 3
    I had to use sudo otherwise it clears 0 bytes sudo journalctl --vacuum-size=500M – Nickson Yap Oct 20 '20 at 04:36
  • 3
    What is the use of keeping it so large by default? Do we lose anything by trimming to 500MB? Will we lose the ability to recover data in the event of crash if we keep it low? – Jus12 Mar 16 '21 at 07:18
76

You can also clean based on time: journalctl --vacuum-time=10d

# du -sh /var/log/journal
113M    /var/log/journal
# journalctl --vacuum-time=10d
Deleted archived journal /var/log/journal/f77f9567bb70f8e7b5d9a0c95bef5c2a/system@36170b4530af4c89ac4d84ac68f8b727-0000000000000001-00057b09da23eb2c.journal (8.0M).
Deleted archived journal /var/log/journal/f77f9567bb70f8e7b5d9a0c95bef5c2a/user-1000@54176301a0c74c4698c3b6a549e1b2ed-0000000000000874-00057b0c1a491094.journal (8.0M).
. . .
Deleted archived journal /var/log/journal/f77f9567bb70f8e7b5d9a0c95bef5c2a/user-1000@e6ecd2f858d1498b9a445af7bac00bbf-000000000000063a-0005848ac99802b3.journal (8.0M).
Vacuuming done, freed 88.0M of archived journals from /var/log/journal/f77f9567bb70f8e7b5d9a0c95bef5c2a.
root@monroe:/var/log# du -sh /var/log/journal     
25M     /var/log/journal
Dan Anderson
  • 1,121
  • 3
    that command worked. ncdu revealed that journal logs were taking lots of space. i just cleared about 3.8GB of space on my ssd. really needed some free space. – Silver Moon Apr 25 '21 at 15:53