[systemd-devel] How to completely clear journal?

[Manuel Reimer]

David Strauss <david <at> davidstrauss.net> writes:
> You can store the last cursor you had in each dump (even in memory
> somewhere) and tell journalctl to start from that the next time using
> --after-cursor=.

Another option seems to be to store a timestamp in memory and use --since.
Maybe this is even more error proof as a cursor could maybe get invalid if
the log really exceeds my 1M limit.

Thanks for the help. I think your idea with never deleting the in-memory
ringbuffer and just reading the part, I need, seems to be the easiest
solution for my problem.

Greetings,

Manuel