(responding to sixpack13)
...
But I'm not sure I should do anything that affects current
journal
files, and there are a few. I looked at the man page. Maybe I'm
incorrectly understanding the --rotate, --update-catalog, and --sync,
but it looks like it will affect currently active log files. My
"/run/log/journal/" is empty, so the --flush is not needed. So how do I
safely clean out everything predating a specific date?
Is there a way (an app, a tool) to have logs automatically removed once
they're a certain number of days old? I completely shutdown every night.
short answer:
==========
one is called "rm".
another could be "journalctl --vacuum-something".
for the seconds one:
I have difficulties to pick what it in what combination does (I need to play with it).
But I already have marked in my above comment it could be "imperfect" !
1. sudo find /var/log/journal -mtime +1 -print0 | xargs -0 sudo rm -rf;
2. sudo journalctl --update-catalog;
finds and deletes all journals elder then 24 h and tells the journal catalog to update
it's index.
- maybe the first "sudo" is superfluous -
long answer:
==========
please carefully read "man journalctl"
and
my commands I provided esp. "sudo rm -rfv /var/log/journal/*/*@*;"
it only removes elder(!) "archive" journal files.
elder files are all which carries a "@" in it's name !
the current journal files are starting with "system" and "user" in
it's name are untouched !
current journal files and archives do I generate with
"--rotate"
from manpage:
"Asks the journal daemon to rotate journal files. ... Journal file rotation has the
effect that all currently active journal files are marked as archived and renamed,
..."
=> the files with "@" in it's name !
"--flush"
dito manpage:
"Asks the journal daemon to flush any log data stored in /run/log/journal/ into
/var/log/journal/"
I guess "/run/log/journal/" is a/are the log file(s) in RAM.
the other parameter I have used:
"--update-catalog"
dito manpage:
"Update the message catalog index. This command needs to be executed each time new
catalog files are installed, removed, or updated to rebuild the binary catalog
index."
I did a remove with my rm -rf command so the index is out of sync !
" --sync"
dito manpage:
"Asks the journal daemon to write all yet unwritten journal data to the backing file
system and synchronize all journals"
so all in all:
=========
my journalctl commands or the parameter could be improved that's for sure.
BUT, it works for me: it removes elder files !
you "@home user" are free to excute what I have provided on your questions.
all what I provide is proofed and excuted by myself sometimes just BEFORE I put it on this
list !!!
Sure, it could be imperfect and sometime it is.