[systemd-devel] How to remove *~ journal files?

[Lennart Poettering]

On Sun, 09.08.15 09:57, Andrei Borzenkov (arvidjaar at gmail.com) wrote:

> More than half of all files here are *~ files:
> 
> bor at opensuse:~/src/systemd> ls -1 /var/log/journal/40527be2480f8cf60f4e8d4b000006b0/*~ | wc -l
> 85
> bor at opensuse:~/src/systemd> ls -1 /var/log/journal/40527be2480f8cf60f4e8d4b000006b0/* | wc -l
> 127
> 
> If I understand it correctly they are corrupted files. Should not they
> have been deleted? What is the correct procedure to remove them?

As Mantas already suggested: these are *not* corrupted files. These
are simply files which journald found on startup where the "dirty" bit
in the header was not unset on last access. i.e. files that weren't
closed cleanly, maybe because the system was shutdown forcibly without
terminating journald cleanly, or because journald died or similar.

journalctl will read those files just fine usually, only the final
bits might not have been synced to disk fully, and journalctl tries
hard to read as much as it can still.

We simple move these files away (and mark them with the trailing ~),
to avoid breaking them by writing further data to it. Instead we start
new files.

Hence: do not delete them, they are still useful. journald will clean
them up eventually, like any other journal files. You can use
"journalctl --vacuum-size=" or "journactl --vacuum-time=" in order to
do one-time cleaning. But note that this will not distuingish journal
files with or without the "~", it strictly deletes the oldest files
regardless if "dirty" or not "dirty".

BTW, if you keep collecting these files, then this is usually an
indication that journald is flaky or you keep rebooting the machine
too often in a "hard" way. If journald works fine and you always
shutdown cleanly you should never get any of these at all.

Lennart

-- 
Lennart Poettering, Red Hat