Introduction

Log files & the systemd journal do the same thing in different ways. They keep a record of everything that happens on your computer system. This makes it possible to understand what is going right & what is going wrong. As an example, if your system had been infiltrated by an ssh attack, this could be verified in the log/journal. So these log files are good for more than tracking troublesome hardware, or driver problems, badly written network manager code or the plethora of other problems that the complex & dynamic GNU/Linux system has to deal with.

These logs are an absolute blessing, as not all systems have them, & any server administrators who does have them would be very grateful as they can be the bread & butter of what they do.

Generally only server administrators have use for logs that go back any length of time. Few users who run distros on their desktop, Notebook, Netbook... machines, need to keep such huge log files, histories going back for many months or even years, on their system, are a waste of space & also makes viewing your log files more cumbersome.

The first topic on this page will briefly cover the systemd journal

The systemd journal has taken the place of log files though it has an option for the standard type log files to be created & maintained in the usual fashion, which is the way that Manjaro does it. Unfortunately there are still plenty of bugs in systemd & using the method presented below, for limiting the size of the /var/log/journal/* works for some but not for others, it also works more effectively for some & only somewhat effectively for others, meaning it will limit the size of the journal, but not to the limit that you set? As systemd's development continues this problem should eventually change.

The second topic will cover handling log files

This topic will go into far more depth, it will covering the use of the logrotate command, logrotate.conf, the /etc/cron.daily cron.weekly cron.monthly cron.yearly, some ways to run created scripts, & a mention of the crontab method of running a script also. I'll try to make this section accessible to as many people as possible, which means this will be a long page.

The journal & the logs duplicate the same information

You can read the text of the log files in a text editor, or using the cat, more, less & such commands as you would on any other text file. The journal on the other hand requires the journalctl command to be able to access its contents. The following is a good way to read the journal:

sudo journalctl | more

How to set a maximum size limit for the journal

You need to use your text editor with root priviliges, starting it with sudo will do the job.

With a simple edit of the /etc/systemd/journald.conf you can set the maximum size limit of the /var/log/journal .

Uncomment the following line & add the size limit that you want. I set mine to 50MB like this:

SystemMaxUse=50M

After a reboot, you should find that your journal is now somewhat less than 50MB (or whatever limit you set), as it needs to have some working space. Mine went to 38M from 391M.

See the troubleshooting section if the above did not work for you.

Handling /var/log/*.log files

Introducing Logrotate & friends

/etc/logrotate.conf holds general settings for the /usr/bin/logrotate command that are applied to some of the /var/log/ files.

logrotate is called however often it is set to be called. Meaning, it can be called from any of the following directories that reside in /etc/ cron.hourly, cron.daily, cron.weekly, cron.monthly, cron.yearly, by placing a script that calls it into any of these previously mentioned directories. (All of which bar the cron.yearly exist by default in Manjaro.)

Logrotate can also be called to run at any time via crontab .

The logrotate.conf , as well as whatever commands it contains, also runs any scripts that are located in the /etc/logrotate.d which it does via the following command:

include /etc/logrotate.d

Some installed applications drop scripts into /etc/logrotate.d to aid in their own maintenance one way or another. We can use another location of our choosing for these or other scripts if we want, we just have to call its path the same way, as in the following is an example:

include /home/handy/.config/mylogrotate

Apart from adding our own scripts to /etc/logrotate.d (or any other path that we have included, we can also add scripts into the previously mentioned /etc/ cron.hourly, cron.daily, cron.weekly, cron.monthly, folders.

So you can see there are multiple ways to call logrotate.

Some uses for Logrotate

For example, if we wanted to rotate all of the .log files in our /var/log/ directory (some .log files will not be affected by this command) on a daily basis; keep the rotated files for 7 days before they are deleted (meaning there would be 7 separate log files for the week); compress the files but do it on the next cycle; do it in a fashion where the original contents of the file is copied before the original file's contents is deleted; do nothing if the file is empty; if the file is missing don't give an error; we should be able to do that with the following:

/var/log/*.log {
 daily
 rotate 7
 compress
 delaycompress
 copytruncate
 notifempty
 missingok
  }

Now if we put the previous into a script by itself, or with other similar blocks of code that have been tailored to suit different files contained in /var/log/ , into the /etc/logrotate.d/ directory & we have /etc/logrotate.conf being called daily, then logrotate.conf will run any scripts that we have in logrotate.d everyday for us thus our log files will be rotated as we have instructed.

Troubleshooting

The above commands don't work for everyone, there are a few workarounds that work for some users I'll post some of them in the future. Some are in the forum topic on this subject, see below.

Support

Following is a link to this page's forum counterpart where you can post any related feedback: [1]

Limit the size of .log files & the journal

Contents