665
Remember to not to forget clearing your journal (lemmy.world)
submitted 4 months ago by bali10050@lemmy.world to c/linuxmemes@lemmy.world
62 comments fedilink hide all child comments
top 50 comments
sorted by: hot top controversial new old
[-] morethanevil@lemmy.fedifriends.social 152 points 4 months ago

Cleanup

Check current disk usage:

sudo journalctl --disk-usage

Use rotate function:

sudo journalctl --rotate

Or

Remove all logs and keep the last 2 days:

sudo journalctl --vacuum-time=2days

Or

Remove all logs and only keep the last 100MB:

sudo journalctl --vacuum-size=100M

How to read logs:

Follow specific log for a service:

sudo journalctl -fu SERVICE

Show extended log info and print the last lines of a service:

sudo journalctl -xeu SERVICE

[-] DmMacniel@feddit.org 38 points 4 months ago

I mean yeah -fu stands for "follow unit" but its also a nice coincidence when it comes to debugging that particular service.

[-] lseif@sopuli.xyz 24 points 4 months ago

--vacuum-time=2days

this implies i keep an operating system installed for that long

[-] jbk@discuss.tchncs.de 9 points 4 months ago

something something nix?

[-] slazer2au@lemmy.world 19 points 4 months ago

sudo journalctl --disk-usage

panda@Panda:~$ sudo journalctl --disk-usage  
No journal files were found.  
Archived and active journals take up 0B in the file system.

hmmmmmm........

[-] superkret@feddit.org 12 points 4 months ago* (last edited 4 months ago) 
user@u9310x-Slack:~$ sudo journalctl --disk-usage  
Password:  
sudo: journalctl: command not found
[-] DmMacniel@feddit.org 20 points 4 months ago* (last edited 4 months ago)

seems like someone doesn't like systemd :)

[-] superkret@feddit.org 5 points 4 months ago

I don't have any feelings towards particular init systems.

[-] Scipitie@lemmy.dbzer0.com 4 points 4 months ago

Just curious, what distro do you use that systemd is not the default? (I at least you didn't change it after the fact if you don't have any feelings (towards unit systems ;) ) )

[-] superkret@feddit.org 5 points 4 months ago

Slackware

[-] kralk@lemm.ee 9 points 4 months ago

Badass! Thanks!

[-] Tekkip20@lemmy.world 8 points 4 months ago

Thank you for this, wise sage.

Your wisdom will be passed down the family line for generations about managing machine logs.

[-] morethanevil@lemmy.fedifriends.social 5 points 4 months ago

Glad to help your family, share this wisdom with friends too ☝🏻😃

load more comments (1 replies)
[-] elxeno@lemm.ee 6 points 4 months ago

@RemindMe@programming.dev 6 months

load more comments (3 replies)
[-] Pacmanlives@lemmy.world 3 points 4 months ago

Actually something I never dug into. But does logrotate no longer work? I have a bunch of disk space these days so I would not notice large log files

load more comments (5 replies)
load more comments (4 replies)
[-] RobotZap10000@feddit.nl 31 points 4 months ago

Try 60GB of system logs after 15 minutes of use. My old laptop's wifi card worked just fine, but spammed the error log with some corrected error. Adding pci=noaer to grub config fixed it.

[-] xilophor@lemmy.world 24 points 4 months ago

I had an issue on my PC (assuming faulty graphics driver or bug after waking from sleep) that caused my syslog file to reach 500GiB. Yes, 500GiB.

[-] PenisDuckCuck9001@lemmynsfw.com 10 points 4 months ago* (last edited 4 months ago)

Nearly 700gb in logs

wtf 🤯

load more comments (1 replies)
[-] possiblylinux127@lemmy.zip 30 points 4 months ago

You just need a bigger drive. Don't delete anything

[-] b00m@lemmy.world 10 points 4 months ago

Oh lord watch me hoard

[-] Andrew15_5@mander.xyz 30 points 4 months ago* (last edited 4 months ago)

*cough*80 GiB*cough*

[-] Ironfacebuster@lemmy.world 5 points 3 months ago

11.6 mega bites

[-] Andrew15_5@mander.xyz 5 points 3 months ago

Ah, yes, the standard burger size.

[-] hushable@lemmy.world 26 points 4 months ago* (last edited 4 months ago)

Once I had a mission critical service crash because the disk got full, turns out there was a typo on the logrotate config and as a result the logs were not being cleaned up at all.

edit: I should add that I used the commands shared in this post to free up space and bring the service back up

[-] wildbus8979@sh.itjust.works 25 points 4 months ago* (last edited 4 months ago)

Fucking blows my mind that journald broke what is essentially the default behavior of every distro's use of logrotate and no one bats an eye.

[-] Regalia@lemmy.blahaj.zone 25 points 4 months ago* (last edited 4 months ago)

I'm not sure if you're joking or not, but the behavior of journald is fairly dynamic and can be configured to an obnoxious degree, including compression and sealing.

By default, the size limit is 4GB:

SystemMaxUse= and RuntimeMaxUse= control how much disk space the journal may use up at most. SystemKeepFree= and RuntimeKeepFree= control how much disk space systemd-journald shall leave free for other uses. systemd-journald will respect both limits and use the smaller of the two values.

The first pair defaults to 10% and the second to 15% of the size of the respective file system, but each value is capped to 4G.

[-] Max_P@lemmy.max-p.me 13 points 4 months ago

If anything I tend to have the opposite problem: whoops I forgot to set up logrotate for this log file I set up 6 months ago and now my disk is completely full. Never happens for stuff that goes to journald.

[-] wildbus8979@sh.itjust.works 4 points 4 months ago* (last edited 4 months ago)

It can be, but the defaults are freaking stupid and often do not work.

[-] Starbuck@lemmy.world 18 points 4 months ago

Aren’t the defaults set by your distro?

load more comments (1 replies)
[-] tentacles9999@lemmynsfw.com 5 points 4 months ago

Still boggles my mind that systemd being terrible is still a debate. Like of all things, wouldn’t text logs make sense?

[-] acockworkorange@mander.xyz 5 points 4 months ago

Wait… it doesn’t store them in plaintext?

[-] uranibaba@lemmy.world 4 points 4 months ago

Nope, you need journalctl to read.

load more comments (1 replies)
[-] tentacles9999@lemmynsfw.com 3 points 4 months ago

Yeah, and you need systemd to read the binary logs. Though I think there may be a setting to change to text logs, I am not sure because I avoid systemd when I can

[-] fallingcats@discuss.tchncs.de 4 points 4 months ago

Wouldn't compressed logs make even more sense (they way they're now)?

[-] muhyb@programming.dev 16 points 4 months ago

This once happened to me on my pi-hole. It's an old netbook with 250 GB HDD. Pi-hole stopped working and I checked the netbook. There was a 242 GB log file. :)

[-] snugglebutt@lemmy.blahaj.zone 11 points 3 months ago

Recently had the jellyfin log directory take up 200GB, checked the forums and saw someone with the same problem but 1TB instead.

[-] Agent641@lemmy.world 17 points 3 months ago* (last edited 3 months ago)

2024-03-28 16:37:12:017 - Everythings fine

2024-03-28 16:37:12:016 - Everythings fine

2024-03-28 16:37:12:015 - Everythings fine

[-] SuperIce@lemmy.world 11 points 4 months ago

Systems/Journald keeps 4GB of logs stored by default.

[-] Muscar@discuss.online 10 points 4 months ago

Title gore

[-] MonkderVierte@lemmy.ml 7 points 3 months ago* (last edited 3 months ago)

logrotate is a thing.

[-] FiniteBanjo@lemmy.today 6 points 4 months ago

Windows isn't great by any means but I do like the way they have the Event Viewer layout sorted to my tastes.

[-] MonkeMischief@lemmy.today 3 points 4 months ago

True that. Sure, I need to keep my non-professional home sysadmin skills sharp and enjoy getting good at these things, but I wouldn't mind a better GUI journal reader / configurator thing. KDE has a halfway decent log viewer.

It might also go a long way towards helping the less sysadmin-for-fun-inclined types troubleshoot.

Maybe there is one and I just haven't checked. XD

[-] Scribbd@feddit.nl 6 points 3 months ago

I recently discovered the company I work for, has an S3 bucket with network flow logs of several TB. It contains all network activity if the past 8 years.

Not because we needed it. No, the lifecycle policy wasn't configured correctly.

[-] alien@lemm.ee 5 points 4 months ago

I couldn't tell for a solid minute if the title was telling me to clear the journal or not

load more comments
view more: next ›
this post was submitted on 01 Aug 2024
665 points (98.5% liked)

linuxmemes

21281 readers
384 users here now

Hint: :q!

Sister communities:

Community rules (click to expand)

1. Follow the site-wide rules

2. Be civil
  • Understand the difference between a joke and an insult.
  • Do not harrass or attack members of the community for any reason.
  • Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.
  • Bigotry will not be tolerated.
  • These rules are somewhat loosened when the subject is a public figure. Still, do not attack their person or incite harrassment.
    • 3. Post Linux-related content
  • Including Unix and BSD.
  • Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of sudo in Windows.
  • No porn. Even if you watch it on a Linux machine.
    • 4. No recent reposts
  • Everybody uses Arch btw, can't quit Vim, and wants to interject for a moment. You can stop now.
    •  

    Please report posts and comments that break these rules!

    Important: never execute code or follow advice that you don't understand or can't verify, especially here. The word of the day is credibility. This is a meme community -- even the most helpful comments might just be shitposts that can damage your system. Be aware, be smart, don't fork-bomb your computer.

    founded 1 year ago
    MODERATORS
    poopsmith@lemmy.world
    zephyr@lemmy.world
    rtxn@lemmy.world