Evaluate systemd logs using Journalctl

Persistent or volatile?

Take a look at the line reading Storage=. While most Linux distributions are configured to store logs continuously, your logs will only be saved to var/log/journal if you set this to Storage=persistent. If you don't want to save the logs, change this to Storage=volatile instead. Doing this means your logs will be stored in /run/log/journal but will be deleted by the daemon once your active session ends.

For more options for controlling the journal size, pull up the man page for journald.conf. If you want to reduce the journal size while it's running, you have two choices. Your first choice is to use the following command to reduce Journal size, for instance to 100 MB. While running as root, enter:

# journalctl --vacuum-size=100M

The program will delete the oldest entries until the Journal reaches the desired size (in this case 100 MB). Your second option is to remove all entries before a certain time:

# journalctl --vacuum-time=1month

The above command discards all messages older than one month (Figure 2), irrespective of how large or small this would make the log file.

Figure 2: Using command line options such as --vacuum-time allows you to reduce the size of your log files without changing your configuration.

Early and Often

The Journald daemon not only records much more data than other logging mechanisms, but actually starts up much earlier in the boot process than was previously possible. This is a huge help when narrowing down system startup problems. Readers who remember the number of photos taken of systems not booting because of a kernel panic or other boot issues on support forums will no doubt relate. Thanks to systemd this is a thing of the past.

Systems using SysVinit [2] do not store messages from the initial stages of the boot process, as the root file system has not yet been mounted as a writable medium. However, systems using systemd create a socket [3] at run time, from which collected messages can be read. The Journal, therefore, offers some significant advantages, despite creating numerous binary files.