How to Clear Systemd Journal Logs in Linux using journalctl

Controlling System Logs

On modern Linux distributions utilizing systemd, virtually every system event, kernel error, and application log is captured by a central daemon called systemd-journald. Over time, these binary log files (stored in /var/log/journal/) can grow to consume gigabytes of valuable disk space, especially on heavily trafficked web servers or machines encountering continuous hardware errors.

While you can configure a hard limit in the journald.conf file, system administrators frequently need to clear out the historical logs instantly to free up storage space. Because the journal files are active binary databases locked by the systemd process, you cannot simply use the rm command to delete them. You must use the dedicated journalctl utility to safely purge the logs.

Checking Current Log Usage

Before you blindly delete files, you should determine exactly how much disk space the journal is currently consuming. Open your terminal and run:

journalctl --disk-usage

The system will output a clean summary, such as: Archived and active journals take up 4.2G in the file system. If this number is alarmingly high for a small VPS with a 20GB drive, it is time to vacuum the logs.

Purging by Size limit

The safest way to clear the logs is to define a maximum size limit. You instruct systemd to delete the oldest log entries until the total size of the journal directory drops below your defined threshold.

To do this, use the --vacuum-size flag. Because you are manipulating system-level files, you must run this command with sudo.

sudo journalctl --vacuum-size=500M

This command immediately purges the oldest archived journal files until the total size is strictly under 500 Megabytes. The terminal will output a list of the specific binary files (e.g., [email protected]) that were deleted and confirm the amount of freed disk space.

Purging by Time Limit

Alternatively, you may want to retain logs based on a specific retention schedule for compliance reasons, regardless of how much space they consume. If you only need to keep logs for the last 14 days, you can use the --vacuum-time flag.

sudo journalctl --vacuum-time=14d

This command deletes any journal entry that is mathematically older than exactly two weeks. You can also specify the time in hours (e.g., --vacuum-time=48h) or even years (--vacuum-time=1years).

Purging by File Count

The final method is to restrict the journal by the absolute number of archived files. While less common than size or time, it guarantees a strict limit on directory clutter.

sudo journalctl --vacuum-files=5

This ensures that only the 5 most recent archive files are kept on the disk; the rest are instantly deleted.

Rotating Active Logs

The vacuum commands primarily target archived journal files. If the currently active journal file (the one systemd is actively writing to right now) is massive, the vacuum command might not free as much space as expected, because it will not delete an active file.

To force systemd to close the massive active file, archive it, and start a fresh, empty one, run the rotate command prior to vacuuming:

sudo journalctl --rotate

Once the massive file is archived, your subsequent --vacuum-size or --vacuum-time commands will successfully target and delete it.