How to clear old journal logs

Clearing old systemd-journald data reclaims disk space before log growth crowds out package installs, database writes, container layers, or other workloads that still share the same local filesystem on a Linux host.

The journal stores persistent logs under /var/log/journal when that directory exists and systemd-journald is configured to keep logs across reboots, or under /run/log/journal when logging stays in volatile storage. The journalctl command reports the current footprint with --disk-usage and removes older archived files with the --vacuum-time, --vacuum-size, or --vacuum-files options.

Manual cleanup needs elevated privileges and permanently removes older local history, so retention requirements should be checked before deleting anything. Vacuum operations delete only archived journal files, which is why adding --rotate first is useful when most of the space is still inside the current active journal file.

Steps to clear old journal logs:

  1. Open a terminal session with an account that can run sudo.

    Deleting journal data permanently removes older local log entries unless they were already exported or forwarded to another logging system.

  2. Check the current journal footprint before deleting anything.
    $ sudo journalctl --disk-usage
    Archived and active journals take up 11.5M in the file system.
  3. Remove archived journal files older than a chosen retention window when recent logs still need to stay available.
    $ sudo journalctl --rotate --vacuum-time=2weeks

    --vacuum-time accepts values such as 7day, 2weeks, or 1month.

  4. Cap the journal at a fixed size when the cleanup target is a disk budget instead of an age window.
    $ sudo journalctl --rotate --vacuum-size=8M
    Vacuuming done, freed 3.5M of archived journals from /run/log/journal/4b8c2f1d3e6a4d2c91a7b5e0f3c8d2a1.
    Vacuuming done, freed 0B of archived journals from /run/log/journal.
    Vacuuming done, freed 0B of archived journals from /var/log/journal.

    Replace 8M with the actual cap that fits the host, such as 500M or 2G.

  5. Retain only a fixed number of archived journal files when file count matters more than age or bytes.
    $ sudo journalctl --rotate --vacuum-files=10

    Only archived files are deleted, so the current active journal file remains until a later rotation.

  6. Confirm the reduced journal footprint after the cleanup pass.
    $ sudo journalctl --disk-usage
    Archived and active journals take up 8.0M in the file system.

    For automatic retention instead of repeated manual vacuum runs, set SystemMaxUse=, RuntimeMaxUse=, or MaxRetentionSec= in /etc/systemd/journald.conf and restart systemd-journald.