In today’s article, we’re going to free up some of your disk space by deleting old logs. It’s a relatively safe and easy thing to do, and can free some space up if you’re running low. Unless there’s a problem, you really don’t need a bunch of old logs kicking around and taking up space.
There are other reasons for deleting old logs, such as keeping things tidy or even ensuring old activities aren’t easily discovered by browsing old log files. You may have done some debugging and now want to start with a new slate, so there’s another reason to delete logs.
Who knows what motivations you’ll have, but today we’ll be covering how to do it. The tool we’ll be using for log cleaning is ‘journalctl’, which is used for (according to the man page):
journalctl – Query the systemd journal
While ‘journalctl’ is a pretty nifty tool, we’re only going to scratch the surface. This article is only about deleting old logs and ‘journalctl’ is just the tool we’ll be using. If you want an article about all the features of ‘journalctl’, this is not that article. See? I’m saving at least a few people some time!
Anyhow, this article obviously requires a distro that uses ‘systemd’. If you don’t have ‘systemd’, you probably don’t have ‘journalctl’ and you’ll have to find another way to delete your logs. As most mainstream distros are using ‘systemd’, there’s a pretty good chance that you have ‘journalctl’ available.
So, with all that preamble gibberish out of the way, let’s go about …
Deleting Old Logs:
Like oh so many articles here, this one requires an open terminal. Why? Because of course it does. If you don’t know how to open the terminal, you can do so with your keyboard – just press
Now, with your terminal open, let’s have a look and see how much space your logs are taking up. You can do that with this command:
1 | sudo journalctl --disk-usage |
Now that you’ve seen how much space your logs are taking up, there are a couple of commands you can use for deleting old logs. If you want to go by space, you can use this command:
1 | sudo journalctl --rotate --vacuum-size=100M |
You can edit the ‘100m’ to whatever suits your needs. You can also use ‘g’ for gigabytes if you’d like to keep using that much log space.
If you want, you can also delete your old logs by the day. Let’s say you want to retain the last 3 days of logs. Well, that command would be:
1 | sudo journalctl --vacuum-time=3d |
I suspect you can figure out that the ‘d’ stands for ‘day’ and the 3 is how many days. You can, of course, change that to any number of days you wish. If you want, you can even use ‘w’ for weeks. Though, if you’re deleting log files to clear up disk space, you’re probably going to want to trim the logs even more than that.
Anyhow, when you’re done running one of the cleaning commands from above, you can verify that the space has been cleaned by running the very first command listed. That will do exactly what it did the first time you ran it – it’ll tell you how much space your logs are taking up. If they’re still not small enough for your liking, feel free to edit and run one of the above commands a second time.
Closure:
Well, there you have it… You have another article! This time I tell you how to go about cleaning old logs from your system. It’s a handy skill to have, though most folks probably have ample disk space – except those running on stuff like Chromebooks or the likes. If you’ve gotta live within 16 GB, you’re going to want to keep your logging to a minimum. Also, I still haven’t skipped a day from writing articles. It seems likely that I’ll do so eventually!
Thanks for reading! If you want to help, or if the site has helped you, you can donate, register to help, write an article, or buy inexpensive hosting to start your own site. If you scroll down, you can sign up for the newsletter, vote for the article, and comment.
systemd has within it the functionality to create and store logs of processes
My limited understanding is that from boot up, because processes and daemons are running, logs will likely to be produced on the fly as well as those already stored to file.
The use of the rotate flag is a way of marking the current active log files as an archive and creating a fresh logfile.
The flush flag evokes the journal daemon to flush any log data stored in /run/log/journal/ into /var/log/journal/
So you can do both to get things started with this command :
sudo journalctl --flush --rotate
Then to reduce the volume of systemd log files you can use time such as :
sudo journalctl --vacuum-time=10sthe above cleans out everything to logs produced in the last 10 seconds , or:
sudo journalctl –vacuum-size=50M
In the above we trim log size to 50 mebabytes
Now it maybe that you are doing some web development on your PC. Systemd won’t touch those unless you make use of :
Apache Module mod_journald
But there is another approach if you like to keep things separate, using the package logrotate , even better if your, an ex Slackware control freak , you will of course want to evoke things manually
On Arch you can install the pkg using :
sudo pacman -S logrotate
Then you add the files you want to trim in the config file
/etc/logrotate.conf
such as :
/var/log/httpd/andrinaWeb.com-access_log
{
minsize 1M
rotate 1
}
in the above i write with path the logfile that when logrotate is evoked will clear
I will do that , manually when i think its an appropriate time using :
sudo logrotate -vf /etc/logrotate.conf
v is verbose and f flag is force
Heck, that’s almost an entire article’s worth of info. Good stuff!