Well, I didn’t had major issues within the last weeks… and I really don’t care about the logs being kept for longer than really necessary. Okay, 2 days might be quiet a short span of time. But on the other hand I didn’t had anything relevant which might be revisited later on… several months of logs seems to be excessive in my use case.
$ journalctl --disk-usage
Archived and active journals take up 1.5G in the file system.
$ sudo journalctl --vacuum-time 2d
Vacuuming done, freed 1.4G of archived journals from /var/log...
yeah it was tianji docker container that went insane. I had fixed that this weekend when I kept hearing the hard drive heads moving. Didn’t realize it was writing to journal too.
journalctl --disk-usage
Journal file /var/log/journal/0f804eb3cd2545268be68970f408ebaa/system@000631f83a943943-d4d48c3298d255e1.journal~ is truncated, ignoring file.
Archived and active journals take up 3.9G in the file system.
Mine is about 350 MB. Near to the sizes reported by @Noodly and @UncleSpellbinder. Have to catch up on and backup and archiving of old journal entries.
@joekamprad for desktop maybe 1-3 months of journal logs should be enough. But on some servers, I have seen logs being archived upto 6 months or more. These archived logs were kept in a separate NFS mount. The reason given was for forensic and regulatory purposes. Still am skeptical on both of the points.