🐥 How to safely clean up /var/log/journal on Ubuntu Server

System logs are essential for monitoring and debugging, but over time, they can consume significant disk space. On Ubuntu Server, system logs are managed by systemd-journald and stored in /var/log/journal. If left unchecked, these logs can grow indefinitely, impacting system performance and available disk space.

In this guide, we’ll go over the proper ways to clean up and manage journal logs efficiently.

Before cleaning up logs, it's helpful to see how much space they are using. Run the following command:

journalctl --disk-usage

This will display the total space consumed by journal logs.

If you want to remove logs older than a certain period, such as two weeks, use:

journalctl --vacuum-time=2w

This ensures you keep recent logs while freeing up space.

To ensure logs don’t exceed a certain size, you can clean up excess logs by setting a size limit. For example, to reduce logs to 500MB:

journalctl --vacuum-size=500M

This will automatically delete older logs until the total size is within the specified limit.

Instead of setting a size limit, you can specify the number of log files to retain. For example, to keep only the last 5 log files:

journalctl --vacuum-files=5

To prevent logs from growing too large in the future, modify the journald configuration.

Edit the configuration file:

sudo vim /etc/systemd/journald.conf

Add or update the following settings:

SystemMaxUse=500M
SystemKeepFree=1G
SystemMaxFileSize=100M
SystemMaxFiles=5

Save the file and restart systemd-journald for changes to take effect:

sudo systemctl restart systemd-journald

If you need more details on the configuration settings of journald, this list gives you a good overview.