Skip to main content
Unix & Linux

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

5
  • 1
    I found 2 directories with hexadecimal name in ./journal. The journalctl commands only works in the most recent one. So I had to delete the old directory manually and that is safe. After I just limit the size in journal conf. Commented Feb 19, 2019 at 20:40
  • 2
    On Ubuntu Server 20.04, that folder you mentioned exists, but there was nothing in it (ls -lah /run/log/journal/). Commented Aug 2, 2020 at 12:25
  • 1
    On Ubuntu the directory appears to be /var/log/journal/*. Commented Nov 15, 2020 at 20:32
  • Are you sure? What did you do after performing this action and how did you verify? I'm preparing RHEL 7 and RHEL 8 virtual machines for templateing with cloud-init and while loglines with older timestamps appear to be gone I can see the old hostname on the RHEL 7 machine which has no --rotate option. Yes you are messing with journald and delete its files (I'm even restarting journald system unit), but I think systemd in its design to be modern and trustworthy bites back and posts the content it has in memory right back. It might take a reboot, but it's there. Commented Jan 30, 2021 at 17:32
  • Regarding my previous comment I found that the hostname is compiled in the initrd: unix.stackexchange.com/a/284551/49853 and dracut -f -v solves my problem on RHEL 7. I opted for a solution using find since in some shells or under some circumstances expansion may not work: find "/run/log/journal/" "/var/log/journal/" "/var/run/log/journal/" -type f -delete. Commented Jan 31, 2021 at 3:13