When I issue
journalctl I get a massive log of all system services, but where is all this information stored?
FILES /etc/systemd/journald.conf Configure systemd-journald behavior. See journald.conf(5). /run/log/journal/machine-id/*.journal, /run/log/journal/machine-id/*.journal~, /var/log/journal/machine-id/*.journal, /var/log/journal/machine-id/*.journal~ systemd-journald writes entries to files in /run/log/journal/machine-id/ or /var/log/journal/machine-id/ with the ".journal" suffix. If the daemon is stopped uncleanly, or if the files are found to be corrupted, they are renamed using the ".journal~" suffix, and systemd-journald starts writing to a new file. /run is used when /var/log/journal is not available, or when Storage=volatile is set in the journald.conf(5) configuration file.
man journalctl says:
journalctl may be used to query the contents of the systemd(1) journal as written by systemd-journald.service(8).
These logs are managed by the
systemd-journald service, so a more appropriate term would be "
Note however that Ubuntu is not using a persistent journald log file by default. Only the volatile
/run/log/journal/<machine-id>/*.journal[~] is kept until the next boot. All is lost at each reboot.
You may see a list of boot retained in the log with:
The logs are still kept in a text file under
/var/log unless you have activated the use of persistent journald log by creating
Usually the storage directory is
/run/log/journal, but it doesn't have to necessarily exist in your system.
If you just want to check the amount of space that the journal is currently occupying on your disk, simply type:
$ journalctl --disk-usage
The storage directory depends on journald configuration.
Configuration files are:
/etc/systemd/journald.conf /etc/systemd/journald.conf.d/*.conf /run/systemd/journald.conf.d/*.conf /usr/lib/systemd/journald.conf.d/*.conf
There the "
Storage=" option controls whether to store journal data or not, and where. Possible values are "
auto" and "
none". Defaults to "
volatile", journal log data will be stored only in memory, i.e. below the /run/log/journal hierarchy (which is created if needed).
persistent", data will be stored preferably on disk, i.e. below the /var/log/journal hierarchy (which is created if needed), with a fallback to /run/log/journal (which is created if needed), during early boot and if the disk is not writable.
auto" is similar to "
persistent" but the directory
/var/log/journal is not created if needed, so that its existence controls where log data goes.
none" turns off all storage, all log data received will be dropped.
In addition to Muru's answer on where data is stored there are other relevant answers.
$ sudo mkdir -p /var/log/journal $ sudo systemd-tmpfiles --create --prefix /var/log/journal
$ journalctl --vacuum-size=200M Deleted archived journal /email@example.com~ (56.0M). Deleted archived journal /firstname.lastname@example.org~ (8.0M). Deleted archived journal /email@example.com (112.0M). Vacuuming done, freed 176.0M of archived journals on disk.