Mastering journalctl: Persistent Systemd Log Management and Cleanup

journalctl Log Management

systemd Log Management

systemd provides its own logging system called journal. No extra syslog service is required. Use journalctl to read logs.

# Read systemd logs
journalctl

By default, when Storage=auto in /etc/systemd/journald.conf, logs are stored in /var/log/journal/. If that directory is missing, logs go to /run/systemd/journal and are lost after reboot.

Configure Persistent Storage

On CentOS 7 the default location is /run/log/journal, which is a tmpfs and cleared on reboot. To keep logs after reboot, set Storage=persistent in /etc/systemd/journald.conf and restart the service.

# Configure persistent storage
sed -i 's/^#Storage=auto/Storage=persistent/' /etc/systemd/journald.conf
SystemMaxUse=128M

Restart the daemon to apply:

# Restart systemd-journald
systemctl restart systemd-journald
# Show current disk usage
journalctl --disk-usage

Log Size Limits

Modify SystemMaxUse to limit total journal size, e.g., 50 MiB:

# Limit journal size to 50MiB
vim /etc/systemd/journald.conf
SystemMaxUse=50M

Or use a drop‑in file:

# /etc/systemd/journald.conf.d/00-journal-size.conf
[Journal]
SystemMaxUse=50M

Configure rsyslogd and systemd‑journald

# Create persistent directory
mkdir -p /var/log/journal
mkdir -p /etc/systemd/journald.conf.d
# Write configuration
cat > /etc/systemd/journald.conf.d/99-prophet.conf <<EOF
[Journal]
Storage=persistent
Compress=yes
SyncIntervalSec=5m
RateLimitInterval=30s
RateLimitBurst=1000
SystemMaxUse=10G
SystemMaxFileSize=200M
MaxRetentionSec=2week
ForwardToSyslog=no
EOF
# Reload or restart
systemctl restart systemd-journald

When /var/log/journal is missing

# Change Storage to persistent
vim /etc/systemd/journald.conf
Storage=persistent
systemctl restart systemd-journald

Automatic Log Deletion

Use journalctl options to control cleanup, e.g., --vacuum-time, --vacuum-size, --vacuum-files.

# Flush and rotate logs
journalctl --flush --rotate
# Delete entries older than 1 second
journalctl --vacuum-time=1s
# Keep only the last 400 MiB
journalctl --vacuum-size=400M
# Keep only the last 2 files
journalctl --vacuum-files=2

Inspect Log Integrity

# Verify journal files
journalctl --verify