Why are journald logfiles so huge

journaldloggingsystemd

When I do a journalctl --disk-usage it says something about 300MB size of the journal files but when I look at the actual text with journalctl | wc -c it's something about 28MB. Well, journald has compression and even considering the metadata like timestamp, uid, message hash and such things it seems to me like a ridiculous waste of disk space.

Can someone tell me why the journal files are so big compared to the actual text inside?

Best Answer

There are two reasons. First, as @Mella mentioned, there is the difference between the current-log vs all-logs.

Second, as documented in man journalctl, there a number of output formats. You were measuring the size of the most-compact/least-detailed. To see maximal data in the systemd journal, use:

journactl --output=verbose

In my case, the compact journal output returns 32 Megs of data, while 128 MB are returned with --output=verbose and 152M are found with journalctl --disk-usage, covering both active and archived journals.

See man journald.conf to learn how to limit how much disk space journald uses if you are concerned.

Related Topic