Ubuntu Log File Management: Clear System Logs Safely

Introduction

System logs are essential for monitoring server health, troubleshooting issues, and maintaining security. However, log files can consume significant disk space over time, potentially causing storage issues on your Ubuntu system. Proper log management ensures your system runs efficiently while preserving important diagnostic information. This article covers safe methods to clear system logs on Ubuntu, including automated rotation strategies, manual cleanup techniques, and best practices for maintaining optimal disk usage without losing critical system information.

Prerequisites

Before following this guide, ensure you have:

• An Ubuntu machine (18.04 or later)
• Root or sudo privileges
• Basic command-line familiarity
• At least 1 GB of available disk space for safety

Understanding Ubuntu Log Structure

Ubuntu stores system logs in several key locations that serve different purposes. The primary log directory /var/log contains most system logs, including kernel messages, application logs, and service-specific information. The systemd journal stores logs in /var/log/journal and maintains both persistent and volatile logs depending on your configuration. Authentication logs reside in /var/log/auth.log, while system messages appear in /var/log/syslog.

Understanding this structure helps you target specific log types for cleanup while preserving important diagnostic information.

Check Current Log Usage

Assess your current log file sizes before performing any cleanup operations. This baseline helps you understand which logs consume the most space and track cleanup effectiveness.

Check total log directory size.

$ sudo du -sh /var/log

List the largest log files in descending order.

$ sudo du -sh /var/log/* | sort -hr | head -10

Check systemd journal disk usage.

$ sudo journalctl --disk-usage

The output displays total space consumed by journal logs, helping you prioritize cleanup efforts.

Configure Log Rotation

Log rotation prevents excessive disk usage by automatically archiving and compressing old log files. Ubuntu uses logrotate to manage this process for most system logs.

View the main logrotate configuration.

$ sudo cat /etc/logrotate.conf

Check application-specific rotation rules.

$ sudo ls -la /etc/logrotate.d/

Edit the main configuration to modify global rotation settings.

$ sudo nano /etc/logrotate.conf

Modify key parameters like rotation frequency (daily, weekly, monthly) and retention count (rotate 4 keeps 4 old copies).

Test logrotate configuration without making changes.

$ sudo logrotate -d /etc/logrotate.conf

The debug mode shows what actions logrotate would perform without executing them.

Clear Systemd Journal Logs

The systemd journal can consume significant disk space, especially on busy systems. Several methods allow you to control journal size while maintaining recent log history.

View current journal configuration.

$ sudo journalctl --show-disk-usage

Clear all journal logs older than a specific time period.

$ sudo journalctl --vacuum-time=7d

This command removes journal entries older than 7 days while preserving recent logs.

Limit journal size by total disk usage.

$ sudo journalctl --vacuum-size=100M

The vacuum-size option removes old logs until the total journal size reaches the specified limit.

Configure persistent journal size limits.

$ sudo nano /etc/systemd/journald.conf

Add or modify these lines to control journal growth:

SystemMaxUse=100M

SystemKeepFree=500M

SystemMaxFileSize=10M

Restart the systemd-journald service to apply configuration changes.

$ sudo systemctl restart systemd-journald

Clear Specific Log Files

Manual log file clearing provides immediate disk space relief for specific applications or services. This approach requires careful consideration to avoid removing important diagnostic information.

Clear Apache access logs while preserving the file structure.

$ sudo truncate -s 0 /var/log/apache2/access.log

The truncate command empties the file without deleting it, allowing services to continue logging.

Clear system log files safely.

$ sudo truncate -s 0 /var/log/syslog

$ sudo truncate -s 0 /var/log/kern.log

Remove compressed log archives to free additional space.

$ sudo rm /var/log/*.gz

$ sudo rm /var/log/*/*.gz

[!WARNING] Removing compressed logs permanently deletes historical log data that may be needed for troubleshooting or compliance requirements.

Clear application-specific logs.

$ sudo find /var/log -name "*.log" -type f -exec truncate -s 0 {} \;

This command finds all .log files and empties them while preserving file permissions and ownership.

Automate Log Cleanup

Automated cleanup prevents future disk space issues by implementing scheduled maintenance tasks. This approach ensures consistent log management without manual intervention.

Create a custom log cleanup script.

$ sudo nano /usr/local/bin/cleanup-logs.sh

Add the following content:Learn how to manage and clear log files safely in Ubuntu to maintain system performance and prevent disk space issues.

#!/bin/bash

  # Clear journal logs older than 7 days

  journalctl --vacuum-time=7d

  # Limit journal size to 100MB

  journalctl --vacuum-size=100M

  # Force logrotate execution

  logrotate -f /etc/logrotate.conf

  # Clear temporary files

  find /tmp -type f -atime +7 -delete

  echo "Log cleanup completed on $(date)"

Make the script executable.

$ sudo chmod +x /usr/local/bin/cleanup-logs.sh

Add a cron job to run the cleanup script weekly.

$ sudo crontab -e

Add this line to execute the script every Sunday at 2:00 AM:

0 2 * * 0 /usr/local/bin/cleanup-logs.sh >> /var/log/cleanup.log 2>&1

Monitor Log Space Usage

Regular monitoring helps prevent disk space issues and ensures your log management strategy remains effective. Implementing alerts provides early warning of potential problems.

Create a disk space monitoring script.Learn how to manage and clear log files safely in Ubuntu to maintain system performance and prevent disk space issues.

$ sudo nano /usr/local/bin/check-log-space.sh

Add monitoring logic:

#!/bin/bash

LOG_USAGE=$(du -s /var/log | cut -f1)

THRESHOLD=1048576  # 1GB in KB

if [ $LOG_USAGE -gt $THRESHOLD ]; then

    echo "Warning: Log directory exceeds 1GB (${LOG_USAGE}KB used)"

    # Add notification commands here

fi

Schedule regular space checks.

$ sudo crontab -e

Add a daily check at 8:00 AM:

0 8 * * * /usr/local/bin/check-log-space.sh

Best Practices for Log Management

Effective log management balances disk space conservation with diagnostic capability. Following established practices ensures you maintain system visibility while preventing storage issues.

• Configure appropriate retention periods based on your compliance requirements and troubleshooting needs. Most systems benefit from keeping 7-30 days of detailed logs with longer-term summary data.
• Implement log levels appropriately, using DEBUG only during active troubleshooting and INFO or WARN for production systems. This reduces log volume while maintaining useful information.
• Consider centralized logging solutions for multiple servers, allowing you to maintain shorter local retention periods while preserving long-term log history in a dedicated logging system.
• Regular testing of log rotation and cleanup processes ensures they function correctly when needed. Schedule monthly reviews of log management effectiveness and adjust retention policies based on actual usage patterns.

Conclusion

Proper log file management maintains system performance while preserving diagnostic capability. You have configured automated log rotation, implemented cleanup procedures for systemd journal logs, and established monitoring for ongoing space management. The automation scripts and cron jobs you created will prevent future disk space issues, while the monitoring system provides early warning of potential problems. Your Ubuntu system now maintains optimal log storage without losing critical diagnostic information.

Regular review and adjustment of these log management policies ensures they continue meeting your system’s specific requirements as usage patterns evolve.