How to reduce journal disk footprint

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• VMware Aria Orchestrator/Automation (vRA/vRO) appliance /var/log file system frequently reaching critical disk capacity.
• Journal logs are taking the most disk space in the /var/log partition.

Environment

VMware Aria Automation/Orchestrator 8.18.1

Cause

The journal log will grow to the precdefined size in the configuration file.

Resolution

Direct changes to the journald.conf file will not work as they will get reverted back during upgrades or validation checks.

Workaround:

 Lower the persistent limit without touching the RPM's file — add a higher-precedence drop-in instead of editing journald.conf in place:

sudo mkdir -p /etc/systemd/journald.conf.d
sudo tee /etc/systemd/journald.conf.d/99-shrink.conf <<'EOF'
[Journal]
SystemMaxUse=500M
RuntimeMaxUse=20M
EOF

sudo systemctl restart systemd-journald

 

NOTE: The persistent journal log configuration will not reclaim already reserved space. It will only prevent rising the space up to the specified limit in the journald config. It is recommended along with the persistent configuration to apply the runtime reclaim command i.e to retain only the last 200MB of journal logs:

journalctl --vacuum-size=200MB

Additional Information

Systemd merges *.conf fragments in journald.conf.d/ in lexical filename order, last directive wins — since 99-shrink.conf sorts after journald.conf, its SystemMaxUse/RuntimeMaxUse values override the RPM's