From: robin_listas@es.invalid   
      
   On 2026-01-14 23:36, Lawrence D’Oliveiro wrote:   
   > On Wed, 14 Jan 2026 23:14:31 +0100, Carlos E.R. wrote:   
   >   
   >> On 2026-01-14 21:54, Lawrence D’Oliveiro wrote:   
   >>   
   >>> You can’t purge selected lines from a logfile with syslog, either.   
   >>   
   >> Yes, I can and I do.   
   >>   
   >> With config lines in /etc/rsyslog.conf and in logrotate.   
   >   
   > Try the journalctl --vacuum-xxx options, then.   
           --vacuum-size=, --vacuum-time=, --vacuum-files=   
               --vacuum-size= removes the oldest archived   
               journal files until the disk space they use   
               falls below the specified size. Accepts the   
               usual "K", "M", "G" and "T" suffixes (to   
               the base of 1024).   
      
               --vacuum-time= removes archived journal   
               files older than the specified timespan.   
               Accepts the usual "s" (default), "m", "h",   
               "days", "months", "weeks" and "years"   
               suffixes, see systemd.time(7) for details.   
      
               --vacuum-files= leaves only the specified   
               number of separate journal files.   
      
               Note that running --vacuum-size= has only   
               an indirect effect on the output shown by   
               --disk-usage, as the latter includes active   
               journal files, while the vacuuming   
               operation only operates on archived journal   
               files. Similarly, --vacuum-files= might not   
               actually reduce the number of journal files   
               to below the specified number, as it will   
               not remove active journal files.   
      
               --vacuum-size=, --vacuum-time= and   
               --vacuum-files= may be combined in a single   
               invocation to enforce any combination of a   
               size, a time and a number of files limit on   
               the archived journal files. Specifying any   
               of these three parameters as zero is   
               equivalent to not enforcing the specific   
               limit, and is thus redundant.   
      
               These three switches may also be combined   
               with --rotate into one command. If so, all   
               active files are rotated first, and the   
               requested vacuuming operation is executed   
               right after. The rotation has the effect   
               that all currently active files are   
               archived (and potentially new, empty   
               journal files opened as replacement), and   
               hence the vacuuming operation has the   
               greatest effect as it can take all log data   
               written so far into account.   
      
      
   Nope. These options remove entire files, when what I want to do is purge   
   messages of certain age belonging to a certain facility and certain   
   severity, regardless of what file they reside in.   
      
   I repeat: this feature is intentionally not implemented by the journal.   
   They want to make a photograph of the system messages, all of them,   
   intact and secure, never edited or changed to ensure integrity.   
      
      
   --   
   Cheers, Carlos.   
   ES🇪🇸, EU🇪🇺;   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)