对ubuntu22.04版本日志的处理

对ubuntu22.04版本日志的处理

---

1. 查询当前日志，较大

   root@VM-0-6-ubuntu:~# sudo journalctl --disk-usage
   Archived and active journals take up 3.5G in the file system.

   以上，已经占用了3.5G

2. 清理，保存7天的数据

   root@VM-0-6-ubuntu:~# sudo journalctl --vacuum-time=7d
   Vacuuming done, freed 0B of archived journals from /var/log/journal.
   Deleted archived journal /var/log/journal/559fda6fe8fb4b6f8da466cc7c242aa3/system@00062b5c062c6891-a3cd1a660f2821ff.journal~ (8.0M).
   。。。
   /var/log/journal/559fda6fe8fb4b6f8da466cc7c242aa3/system@623febb021d343ed9a26156ca4615267-000000000001242d-0006467ce5f08c7b.journal (72.0M).
   Deleted archived journal /var/log/journal/559fda6fe8fb4b6f8da466cc7c242aa3/system@623febb021d343ed9a26156ca4615267-0000000000023410-000647097b6625dc.journal (72.0M).
   Deleted archived journal /var/log/journal/559fda6fe8fb4b6f8da466cc7c242aa3/system@623febb021d343ed9a26156ca4615267-0000000000034337-0006478e85ffa103.journal (72.0M).
   Vacuuming done, freed 3.4G of archived journals from /var/log/journal/559fda6fe8fb4b6f8da466cc7c242aa3.
   Vacuuming done, freed 0B of archived journals from /run/log/journal.
   root@VM-0-6-ubuntu:~# 

3. 永久更改日志相关配置

   sudo vi /etc/systemd/journald.conf
   
   # 内容
   [Journal]
   #Storage=auto
   Compress=yes
   #Seal=yes
   #SplitMode=uid
   #SyncIntervalSec=5m
   #RateLimitIntervalSec=30s
   #RateLimitBurst=10000
   SystemMaxUse=10%
   #SystemKeepFree=
   SystemMaxFileSize=50M
   #SystemMaxFiles=100
   RuntimeMaxUse=10%
   #RuntimeKeepFree=
   #RuntimeMaxFileSize=
   #RuntimeMaxFiles=100
   MaxRetentionSec=1week
   #MaxFileSec=1month
   #ForwardToSyslog=yes
   #ForwardToKMsg=no
   #ForwardToConsole=no
   #ForwardToWall=yes
   #TTYPath=/dev/console
   #MaxLevelStore=debug
   #MaxLevelSyslog=debug
   #MaxLevelKMsg=notice
   #MaxLevelConsole=info
   #MaxLevelWall=emerg
   #LineMax=48K
   #ReadKMsg=yes
   #Audit=no
   
   #
   以上打开了5项
   1，使用压缩，以节省空间
   2，系统日志最大占10%
   3，单个系统文件最大50M
   4，运行日志文件最大占10%
   5，最大保留7天的日志

4. 更改后重启

   sudo systemctl restart systemd-journald

5. 更改后查看

   root@VM-0-6-ubuntu:~# df -h
   Filesystem      Size  Used Avail Use% Mounted on
   tmpfs           197M  1.1M  196M   1% /run
   /dev/vda2        50G   19G   29G  39% /
   tmpfs           982M  200K  982M   1% /dev/shm
   tmpfs           5.0M     0  5.0M   0% /run/lock
   tmpfs           197M  4.0K  197M   1% /run/user/0
   root@VM-0-6-ubuntu:~# sudo journalctl --disk-usage
   Archived and active journals take up 48.0M in the file system.
   root@VM-0-6-ubuntu:~# 

   空间由45%降到39%，查看文件由3.5G降为48M