We, Linux people, generally use systemd now and one of its components is the journal controlled by the journalctl command line tool.
As explained on the Arch wiki,
“systemd has its own logging system called the journal. The /var/log/journal/directory is a part of the systemd package and the journal will write to /var/log/journal/”
The journal is always appended and therefore grows in size. On my laptop, the journal was taking 1.8Gb of space and was full of details which, I believe, I’ll never need. So I decided to clear all old contents (which the systemd people call a vacuum). I issued:
journalctl --rotate
journalctl --disk-usage
journalctl --vacuum-size=64M
journalctl --disk-usageAnd the journal immediately became smaller. I then issued a
journalctl --verifywhich made me realise that some of the remaining journal files were corrupted (for some reason). There is no journal repair tool in systemd so I simply removed the offending files (with rm).
The –rotate command is required because journalctl cannot safely delete or vacuum an active, currently open log file. In practice, rotating closes the active files and enables deletion of the closed files. It also starts fresh logs.
Now, I can easily check my journal entries for today and I know everything will be all fine:
journalctl --since todayAlternatively, one can also delete all “old” journal entries e.g. everything before one week ago by issuing:
journalctl --rotate
journalctl --disk-usage
journalctl --vacuum-time=7d
journalctl --disk-usage
journalctl --verify