What is an acceptable size for journalctl on single personal computer?

[JohnML]

i have now:

[john1@manjaro ~]$ journalctl --disk-usage
Archived and active journals take up 205.5M in the file system.

… and there a really lots of files

[john1@manjaro f5cca6a2eef242e0a5619690cbc6aa0a]$ ls -lha ./*
-rw-r-----+ 1 root systemd-journal 5,0M  3. Sep 21:03 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e077d-000604790aee86e8.journal
-rw-r-----+ 1 root systemd-journal 4,4M  3. Sep 19:03 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e0d4c-000604790b4e3201.journal
-rw-r-----+ 1 root systemd-journal 4,8M  4. Sep 13:51 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e0e8a-000604775fafd0e0.journal
-rw-r-----+ 1 root systemd-journal 5,0M  4. Sep 13:51 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e12ee-0006048720b522b8.journal
-rw-r-----+ 1 root systemd-journal 7,3M  5. Sep 21:51 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e18bc-000604872119143d.journal
-rw-r-----+ 1 root systemd-journal 5,0M  5. Sep 21:51 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e3f94-000604a1f2c35722.journal
-rw-r-----+ 1 root systemd-journal 4,4M  5. Sep 19:51 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e454b-000604a1f324e998.journal
-rw-r-----+ 1 root systemd-journal 5,5M  7. Sep 18:59 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e4698-000604a04786a867.journal
-rw-r-----+ 1 root systemd-journal 5,1M  7. Sep 18:59 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e5142-000604c7c8dd6325.journal
-rw-r-----+ 1 root systemd-journal 4,4M  7. Sep 17:00 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e5712-000604c7c9419351.journal
-rw-r-----+ 1 root systemd-journal 4,6M  7. Sep 21:45 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e584e-000604c61d9d31c7.journal
-rw-r-----+ 1 root systemd-journal 5,0M  7. Sep 21:45 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e5a4d-000604ca19a44999.journal
-rw-r-----+ 1 root systemd-journal 4,4M  7. Sep 19:45 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e600b-000604ca1a02e27a.journal
-rw-r-----+ 1 root systemd-journal 4,5M  7. Sep 22:28 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e6157-000604c86e5c14db.journal
-rw-r-----+ 1 root systemd-journal 5,0M  7. Sep 22:29 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e6337-000604cab5aefbc5.journal
-rw-r-----+ 1 root systemd-journal 4,4M  7. Sep 20:29 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e68f8-000604cab610adf2.journal
-rw-r-----+ 1 root systemd-journal 4,5M  7. Sep 21:24 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e6a3f-000604c90a682332.journal
-rw-r-----+ 1 root systemd-journal 5,0M  7. Sep 21:25 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e6c17-000604c9d0af9af3.journal
-rw-r-----+ 1 root systemd-journal 5,0M  8. Sep 14:45 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e71f1-000604c9d10e7840.journal
-rw-r-----+ 1 root systemd-journal 5,1M  8. Sep 14:45 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e777d-000604d85b0c29ed.journal
-rw-r-----+ 1 root systemd-journal 4,4M  8. Sep 12:46 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e7d59-000604d85b6dbaa8.journal
-rw-r-----+ 1 root systemd-journal 4,7M  9. Sep 01:01 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e7e87-000604d6afce6307.journal
-rw-r-----+ 1 root systemd-journal 5,0M  9. Sep 01:01 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e81d8-000604e0f5901221.journal
-rw-r-----+ 1 root systemd-journal 4,5M  8. Sep 23:02 ./system@5adf5c1690c242adb4b22354b2238277-00000000003e874d-000604e0f5beda1f.journal
-rw-r-----+ 1 root systemd-journal 8,0M  9. Sep 12:51 ./system.journal
-rw-r-----+ 1 root systemd-journal 4,3M  2. Sep 21:40 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e0164-000604671d7302d8.journal
-rw-r-----+ 1 root systemd-journal 4,4M  3. Sep 21:03 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e0314-000604657f842878.journal
-rw-r-----+ 1 root systemd-journal 4,3M  3. Sep 19:03 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e0d4b-000604790b4d7278.journal
-rw-r-----+ 1 root systemd-journal 4,4M  4. Sep 13:51 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e0e90-000604776050f340.journal
-rw-r-----+ 1 root systemd-journal 4,6M  5. Sep 21:51 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e18bb-0006048721184415.journal
-rw-r-----+ 1 root systemd-journal 4,3M  5. Sep 19:51 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e454a-000604a1f3241cf3.journal
-rw-r-----+ 1 root systemd-journal 4,6M  7. Sep 18:59 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e46a1-000604a0498e2b8f.journal
-rw-r-----+ 1 root systemd-journal 4,3M  7. Sep 17:00 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e5711-000604c7c940ccd5.journal
-rw-r-----+ 1 root systemd-journal 4,3M  7. Sep 21:45 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e5858-000604c623cbf288.journal
-rw-r-----+ 1 root systemd-journal 4,3M  7. Sep 19:45 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e600a-000604ca1a022529.journal
-rw-r-----+ 1 root systemd-journal 4,3M  7. Sep 22:29 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e615d-000604c86efdaf9d.journal
-rw-r-----+ 1 root systemd-journal 4,3M  7. Sep 20:29 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e68f7-000604cab60fe0b8.journal
-rw-r-----+ 1 root systemd-journal 4,3M  7. Sep 21:25 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e6a4b-000604c91ac50fbb.journal
-rw-r-----+ 1 root systemd-journal 4,5M  8. Sep 14:45 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e71f0-000604c9d10dcbf7.journal
-rw-r-----+ 1 root systemd-journal 4,3M  8. Sep 12:46 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e7d58-000604d85b6ced0e.journal
-rw-r-----+ 1 root systemd-journal 4,4M  9. Sep 01:01 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e7e92-000604d6d23f2b58.journal
-rw-r-----+ 1 root systemd-journal 4,3M  8. Sep 23:02 ./user-1000@9c04effc9f3a43459752e8dae8dfac74-00000000003e874c-000604e0f5be10d4.journal
-rw-r-----+ 1 root systemd-journal 8,0M  9. Sep 12:50 ./user-1000.journal

Why not two files with 100 MB?

As you can see, i’m a noob

[Teo]

Don’t manually mess with the files. The almighty systemd does what he has to and archives, deletes, compresses as needed. The default size limit is set to 400MB if i am not mistaken (at least mine grows no bigger than that, some other web pages on other OSes say the default is 4GB, i guess manjaro corrected it). And the oldest entries i see are from one week ago. On a not very actively used system. If a lot of stuff is happening on the system the default 400MB can even become only a day or two. And that is the pure minimum you need if you ever need to debug anything at all when things go wrong.
So i will not advise you to make it smaller.
If you want to make it bigger there are guides for this everywhere, it is just a config file.

[Mirdarthos]

Hi @JohnML,

I don’t think there’s really an acceptable an unacceptable size… I think it’s what works for you. Mine’s quite a bit bigger:

$ journalctl --disk-usage
Archived and active journals take up 684.0M in the file system.

Edit:

More information:

https://wiki.archlinux.org/title/Systemd/Journal#Journal_size_limit

[Nachlese]

One question only you yourself can answer is:
will you actually ever be looking at these logs - especially older, archived logs?
The answer is generally “no”, I’d wager.

If that is so, there is no point in reserving much space for these.

Personally, I set
Storage=volatile
in /etc/systemd/journald.conf

The effect is that no permanent journal at all is created - it is all just virtual.
The possible downside is that there is no journal for previous boots - just the current one.

[Teo]

By the way, here is my journal:

[teo@teo-lenovo-v15 ~]$ journalctl -b -u systemd-journald --no-pager 
Sep 09 15:59:24 teo-lenovo-v15 systemd-journald[314]: Collecting audit messages is disabled.
Sep 09 15:59:24 teo-lenovo-v15 systemd-journald[314]: Journal started
Sep 09 15:59:24 teo-lenovo-v15 systemd-journald[314]: Runtime Journal (/run/log/journal/34d8e0feb1784254849bb0fb83b7491b) is 8.0M, max 387.7M, 379.7M free.
Sep 09 15:59:24 teo-lenovo-v15 systemd-journald[314]: Time spent on flushing to /var/log/journal/34d8e0feb1784254849bb0fb83b7491b is 59.677ms for 780 entries.
Sep 09 15:59:24 teo-lenovo-v15 systemd-journald[314]: System Journal (/var/log/journal/34d8e0feb1784254849bb0fb83b7491b) is 411.4M, max 4.0G, 3.5G free.
Sep 09 15:59:25 teo-lenovo-v15 systemd-journald[314]: Received client request to flush runtime journal.
Sep 09 15:59:25 teo-lenovo-v15 systemd-journald[314]: /var/log/journal/34d8e0feb1784254849bb0fb83b7491b/system.journal: Monotonic clock jumped backwards relative to last journal entry, rotating.
Sep 09 15:59:25 teo-lenovo-v15 systemd-journald[314]: Rotating system journal.
Sep 09 15:59:33 teo-lenovo-v15 systemd-journald[314]: /var/log/journal/34d8e0feb1784254849bb0fb83b7491b/user-1000.journal: Monotonic clock jumped backwards relative to last journal entry, rotating.
Sep 09 15:59:55 teo-lenovo-v15 systemd-journald[314]: Time jumped backwards, rotating.

I played before with the size but then i deleted the addon files in the journald.conf.d so i guess this is the default now. It says 4G but it is 400M in reality. Why?

[Mirdarthos]

Log files are relatively _small. So it will take a LOT of small files to get to the 4GB you set. And that’s the max it can be, so up until then, nothing is discarded.

Also, that is only the output for the

@Teo

systemd-journald

…unit. If you want to see everything just run

journalctl

More:

Using journalctl - The Ultimate Guide To Logging

[Teo]

In my case it is always staying around 400MB after i deleted the /etc/journal.conf.d/size.conf (where i had it set to 2GB and that worked).
I am fine with that but i wonder why since the arch wiki says it should go to 4GB.

Sep 03 19:58:44 teo-lenovo-v15 systemd-journald[318]: Runtime Journal (/run/log/journal/34d8e0feb1784254849bb0fb83b7491b) is 8.0M, max 387.7M, 379.7M free.
Sep 03 19:58:44 teo-lenovo-v15 systemd-journald[318]: Time spent on flushing to /var/log/journal/34d8e0feb1784254849bb0fb83b7491b is 52.073ms for 779 entries.
Sep 03 19:58:44 teo-lenovo-v15 systemd-journald[318]: System Journal (/var/log/journal/34d8e0feb1784254849bb0fb83b7491b) is 417.1M, max 4.0G, 3.5G free.

Sep 09 18:05:41 teo-lenovo-v15 systemd-journald[308]: Runtime Journal (/run/log/journal/34d8e0feb1784254849bb0fb83b7491b) is 8.0M, max 387.7M, 379.7M free.
Sep 09 18:05:41 teo-lenovo-v15 systemd-journald[308]: Time spent on flushing to /var/log/journal/34d8e0feb1784254849bb0fb83b7491b is 54.366ms for 778 entries.
Sep 09 18:05:41 teo-lenovo-v15 systemd-journald[308]: System Journal (/var/log/journal/34d8e0feb1784254849bb0fb83b7491b) is 410.2M, max 4.0G, 3.5G free.

It (something) is actively truncating at ca. 400MB, i can see it in the earliest timestamps available with journalctl.

Maybe it has something to do with rotating and that clock error, which seems to be a bug in systemd according to arch forums, i don’t know.

[Aragorn]

@Teo

The default size limit is set to 400MB if i am not mistaken (at least mine grows no bigger than that, some other web pages on other OSes say the default is 4GB

@Teo

I played before with the size but then i deleted the addon files in the journald.conf.d so i guess this is the default now. It says 4G but it is 400M in reality. Why?

The default size is 20% of the filesystem’s total capacity, although there is an upper limit of — I believe— 4 GiB. But I’d have to read the man page again to be sure.

I’ve set mine to 250 MiB…

[nx-74205:/dev/pts/3][/home/aragorn]
[aragorn] >  grep RuntimeMaxUse /etc/systemd/journald.conf 
RuntimeMaxUse=250M

[Yochanan]

❯ journalctl --disk-usage
Archived and active journals take up 2.7G in the file system.

Time to vacuum…

❯ sudo journalctl --vacuum-size=500M && sudo journalctl --vacuum-time=7d
Vacuuming done, freed XGB of archived journals from blah blah blah...

...

❯ journalctl --disk-usage
Archived and active journals take up 420.5M in the file system.

[JohnML]

I hope following “drop-in” assures that i don’t have any pacdiffs of systemd-journalctl when an update is coming in

[john1@manjaro ~]$ systemd-analyze cat-config systemd/journald.conf
# /etc/systemd/journald.conf
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it under the
#  terms of the GNU Lesser General Public License as published by the Free
#  Software Foundation; either version 2.1 of the License, or (at your option)
#  any later version.
#
# Entries in this file show the compile time defaults. Local configuration
# should be created by either modifying this file, or by creating "drop-ins" in
# the journald.conf.d/ subdirectory. The latter is generally recommended.
# Defaults can be restored by simply deleting this file and all drop-ins.
#
# Use 'systemd-analyze cat-config systemd/journald.conf' to display the full config.
#
# See journald.conf(5) for details.

[Journal]
#Storage=auto
#Compress=yes
#Seal=yes
#SplitMode=uid
#SyncIntervalSec=5m
#RateLimitIntervalSec=30s
#RateLimitBurst=10000
#SystemMaxUse=
#SystemKeepFree=
#SystemMaxFileSize=
#SystemMaxFiles=100
#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=
#RuntimeMaxFiles=100
#MaxRetentionSec=
#MaxFileSec=1month
#ForwardToSyslog=no
#ForwardToKMsg=no
#ForwardToConsole=no
#ForwardToWall=yes
#TTYPath=/dev/console
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#MaxLevelWall=emerg
#LineMax=48K
#ReadKMsg=yes
#Audit=yes

# /etc/systemd/journald.conf.d/10-override-journal.conf
[Journal]
# MaxRetentionSec=864000
SystemMaxUse=250M
# SystemMaxFileSize=150M
# SystemMaxFiles=10
Storage=persistent


[john1@manjaro ~]$ journalctl --disk-usage
Archived and active journals take up 245.6M in the file system.

[leledumbo]

None, as a single personal computer can be a pure office only machine as well as a gaming + video editing + audio production + programming station, which is exactly what my machine is. And I think:

$ journalctl --disk-usage
Archived and active journals take up 1.6G in the file system.

is acceptable to me, as I have a bunch of services flooding the logs, including some of my own.