How do you enforce log expiration with journald?

Question

Suppose I only wanted to keep logs for the last 10 days.

Would I have to run

journalctl --vacuum-time=10d

on a timer every day? Do I need to also use --rotate? What does "rotate journal files" mean?

Could I set something in /etc/systemd/journald.conf? I was reading man 5 journald.conf, but it seems like SystemMaxUse only accepts bytes, not time.

I don't care about the size or the number of files. Just the time the log was recorded.

score 3 · Answer 1 · edited Feb 11 '20 at 09:04

You shoule be able to use --vacuum-time. Something like the following will rotate the current active journal files into the archive and then trim all logs to keep only 10 days in that one log.

journalctl --rotate --vacuum-time=10days

Straight out of man page:

--vacuum-size=, --vacuum-time= and --vacuum-files= may be combined
       in a single invocation to enforce any combination of a size, a time
       and a number of files limit on the archived journal files.
       Specifying any of these three parameters as zero is equivalent to
       not enforcing the specific limit, and is thus redundant.

       These three switches may also be combined with --rotate into one
       command. If so, all active files are rotated first, and the
       requested vacuuming operation is executed right after. The rotation
       has the effect that all currently active files are archived (and
       potentially new, empty journal files opened as replacement), and
       hence the vacuuming operation has the greatest effect as it can
       take all log data written so far into account.

How do you enforce log expiration with journald?

1 Answers1