From: tnp@invalid.invalid   
      
   On 15/01/2026 13:40, Carlos E.R. wrote:   
   > On 2026-01-14 23:36, Lawrence D’Oliveiro wrote:   
   >> On Wed, 14 Jan 2026 23:14:31 +0100, Carlos E.R. wrote:   
   >>   
   >>> On 2026-01-14 21:54, Lawrence D’Oliveiro wrote:   
   >>>   
   >>>> You can’t purge selected lines from a logfile with syslog, either.   
   >>>   
   >>> Yes, I can and I do.   
   >>>   
   >>> With config lines in /etc/rsyslog.conf and in logrotate.   
   >>   
   >> Try the journalctl --vacuum-xxx options, then.   
   >         --vacuum-size=, --vacuum-time=, --vacuum-files=   
   >             --vacuum-size= removes the oldest archived   
   >             journal files until the disk space they use   
   >             falls below the specified size. Accepts the   
   >             usual "K", "M", "G" and "T" suffixes (to   
   >             the base of 1024).   
   >   
   >             --vacuum-time= removes archived journal   
   >             files older than the specified timespan.   
   >             Accepts the usual "s" (default), "m", "h",   
   >             "days", "months", "weeks" and "years"   
   >             suffixes, see systemd.time(7) for details.   
   >   
   >             --vacuum-files= leaves only the specified   
   >             number of separate journal files.   
   >   
   >             Note that running --vacuum-size= has only   
   >             an indirect effect on the output shown by   
   >             --disk-usage, as the latter includes active   
   >             journal files, while the vacuuming   
   >             operation only operates on archived journal   
   >             files. Similarly, --vacuum-files= might not   
   >             actually reduce the number of journal files   
   >             to below the specified number, as it will   
   >             not remove active journal files.   
   >   
   >             --vacuum-size=, --vacuum-time= and   
   >             --vacuum-files= may be combined in a single   
   >             invocation to enforce any combination of a   
   >             size, a time and a number of files limit on   
   >             the archived journal files. Specifying any   
   >             of these three parameters as zero is   
   >             equivalent to not enforcing the specific   
   >             limit, and is thus redundant.   
   >   
   >             These three switches may also be combined   
   >             with --rotate into one command. If so, all   
   >             active files are rotated first, and the   
   >             requested vacuuming operation is executed   
   >             right after. The rotation has the effect   
   >             that all currently active files are   
   >             archived (and potentially new, empty   
   >             journal files opened as replacement), and   
   >             hence the vacuuming operation has the   
   >             greatest effect as it can take all log data   
   >             written so far into account.   
   >   
   >   
   > Nope. These options remove entire files, when what I want to do is purge   
   > messages of certain age belonging to a certain facility and certain   
   > severity, regardless of what file they reside in.   
   >   
   > I repeat: this feature is intentionally not implemented by the journal.   
   > They want to make a photograph of the system messages, all of them,   
   > intact and secure, never edited or changed to ensure integrity.   
   >   
   >   
   I found coincidentally that I had a directory full of a years worth of   
   journal files that could not be eliminated.   
      
   They were of the form user-1000@....and system.jourmal@... all contained   
   the @symbol.   
   I deleted them all manually.   
      
   journalctl is happier   
      
      
   --   
   Climate Change: Socialism wearing a lab coat.   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)