Reducing disk usage by journalctl logs

Systemd is using journalctl as the log keeper for its services. The log location is at /var/log/journal.

To check the disk usage of journalctl log

$ sudo journalctl --disk-usage

To check the logs date, just run 

$ sudo journalctl 

To flush active logs to file, so it can be cleared (vacuum)

$ sudo journalctl --flush

To clear the log, we can use "journalctl --vacuum-size". This below command will reduce the total size used by journalctl log to 1G. This command however, will only work on archived logs, and not active logs.

$ sudo journalctl --vacuum-size=1G

We can also vacuum by date, this command will remove data older than a month. Same with vacuum-size, this will work only to the archived logs.

$ sudo journalctl --vacuum-time=1month 

We can also ask journalctl to rotate its log files, using --rotate. The rotation criteria can be set in /etc/systemd/journald.conf, by editing MaxFileSec and MaxRetentionSec configuration.

$ sudo journalctl --rotate