Master journalctl: Persistent Systemd Logging, Viewing, and Cleanup Tips

journalctl Log Management

systemd provides its own logging system called journal . No additional syslog service is required. Use journalctl to read logs.

# Read systemd logs
journalctl

By default, when Storage=auto is set in /etc/systemd/journald.conf, logs are written to /var/log/journal/. If this directory is missing, logs fall back to /run/systemd/journal, which is volatile and lost after a reboot.

Configure Persistent Storage for systemd-journald

On CentOS 7, logs are stored in /run/log/journal (a tmpfs). To retain logs after reboot, set Storage=persistent in /etc/systemd/journald.conf:

# Configure persistent storage
sed -i 's/^#Storage=auto/Storage=persistent/' /etc/systemd/journald.conf
# Limit log size to 128M
SystemMaxUse=128M

Restart the service to apply changes:

# Restart journald
systemctl restart systemd-journald
# Check current disk usage
journalctl --disk-usage

Log Size Limits

Modify the global configuration to set a maximum log size, e.g., 50 MiB:

# Limit log size to 50MiB
vim /etc/systemd/journald.conf
SystemMaxUse=50M

Or use a drop‑in file:

# /etc/systemd/journald.conf.d/00-journal-size.conf
[Journal]
SystemMaxUse=50M

Configure rsyslogd and systemd-journald

# Create persistent log directory
mkdir -p /var/log/journal
mkdir -p /etc/systemd/journald.conf.d

# Write custom configuration
cat > /etc/systemd/journald.conf.d/99-prophet.conf <<EOF
[Journal]
Storage=persistent
Compress=yes
SyncIntervalSec=5m
RateLimitInterval=30s
RateLimitBurst=1000
SystemMaxUse=10G
SystemMaxFileSize=200M
MaxRetentionSec=2week
ForwardToSyslog=no
EOF

# Reload or restart journald
systemctl restart systemd-journald

journalctl Viewing Logs

Common commands: journalctl -n – show the last 10 lines journalctl -n 20 – show the last 20 lines journalctl -f – follow new entries in real time journalctl -u SERVICE_NAME – view logs for a specific service journalctl -xeu kubelet – detailed view with stack traces journalctl --since today – logs from today journalctl --since "2021-10-02 22:00:00" – logs from a specific time journalctl _UID=33 --since today – logs for a specific user journalctl /usr/bin/bash – logs for a specific command journalctl _PID=1 – logs for a specific process journalctl -b – logs from the current boot (add -1 for previous boot)

journalctl Deleting Logs

Manually trigger log rotation:

# Rotate logs
journalctl --flush --rotate

Delete entries older than a given time:

# Delete logs older than 1 second
journalctl --vacuum-time=1s

Supported time suffixes: s (seconds), m (minutes), h (hours), days, weeks, months, years.

Keep only the most recent logs by size:

# Keep the last 400 MiB of logs
journalctl --vacuum-size=400M

Supported size suffixes: K (KB), M (MB), G (GB).

Keep only a certain number of recent log files:

# Keep the last 2 journal files
journalctl --vacuum-files=2

Verify journal file integrity:

# Verify logs
journalctl --verify

journald.conf Parameters

SystemMaxUse

: maximum disk space for persistent logs (e.g., SystemMaxUse=500M) SystemKeepFree: space to keep free on persistent storage (e.g., SystemKeepFree=100M) SystemMaxFileSize: maximum size of a single log file before rotation (e.g., SystemMaxFileSize=100M) RuntimeMaxUse: maximum disk space for volatile storage (e.g., RuntimeMaxUse=100M) RuntimeKeepFree: free space to reserve on volatile storage (e.g., RuntimeKeepFree=100M) RuntimeMaxFileSize: maximum size of a single volatile log file (e.g., RuntimeMaxFileSize=200M)