Ubuntu 26.04 Tutorial / Configure Journal and File-Log Retention

Ubuntu

Manage journal retention separately from rotation of ordinary text logs. Identify the actual collectors first and preserve needed records before reducing retention, which can delete existing history.

Identify real collection paths

systemctl status systemd-journald rsyslog --no-pager
journalctl --disk-usage
journalctl --list-boots
ls /var/log

A system without rsyslog may not have the familiar /var/log/syslog. Do not rotate binary journal files with logrotate or delete them manually. Check whether each application writes to its own file or the journal.

Verify generation and search filters

logger -t ubuntu-course-log 'retention-lab-marker'
journalctl -t ubuntu-course-log --since '5 minutes ago' --no-pager
journalctl -b -p warning --no-pager

Find the new marker and narrow boot, time, unit, and priority filters as needed. Empty output can mean failed generation or a mismatched query; investigate separately. Do not grant broad system-log access unnecessarily.

Manage journal retention through a drop-in

For a dedicated VM test, back up existing settings and review a file such as /etc/systemd/journald.conf.d/60-lab-retention.conf. These small-lab values are not organizational retention requirements. Lower limits may remove older records.

[Journal]
Storage=persistent
SystemMaxUse=200M
RuntimeMaxUse=50M
MaxRetentionSec=7day

Prepare persistent storage as documented, restart journald at the planned time, and verify journalctl --flush, disk usage, and a new marker. Active files and rotation timing mean a size limit is not necessarily an immediate exact-byte ceiling.

The journald.conf reference explains persistent storage and retention size and time limits.

Apply journal settings and restore the prior state

Test only on a dedicated VM after independently preserving required logs. The code stops if the lab file exists and preserves other administrators’ drop-ins. The 200M/50M/7day limits are small-lab examples; restoring settings cannot recover already removed history.

(
set -eu
lab_conf=/etc/systemd/journald.conf.d/60-lab-retention.conf
if sudo test -e "$lab_conf" || sudo test -L "$lab_conf"; then
    printf 'Existing lab file: inspect it instead of overwriting.\n' >&2
    exit 1
fi
backup_dir=$(sudo mktemp -d /root/journal-before-lab.XXXXXX)
sudo cp -a /etc/systemd/journald.conf "$backup_dir/"
if sudo test -d /etc/systemd/journald.conf.d; then
    sudo cp -a /etc/systemd/journald.conf.d "$backup_dir/"
fi
sudo install -d -m 0755 /etc/systemd/journald.conf.d
sudo sh -c 'set -C; cat > "$1"' sh "$lab_conf" <<'EOF'
[Journal]
Storage=persistent
SystemMaxUse=200M
RuntimeMaxUse=50M
MaxRetentionSec=7day
EOF
sudo systemd-analyze cat-config systemd/journald.conf
printf 'Review configuration and backup: %s\n' "$backup_dir"
)

Review the four values and any later overrides in cat-config before applying below. Restarting the journal service differs from manually deleting its files. Check persistent storage, flush results, marker generation, and retained boot history separately.

sudo systemctl restart systemd-journald.service && sudo journalctl --flush && sudo journalctl --disk-usage
logger -t ubuntu-course-log 'after-retention-change'
sudo journalctl -t ubuntu-course-log --since '5 minutes ago' --no-pager

Restore only the newly created 60-lab-retention.conf after checking that it still contains this lab’s content and has no later edits. Since the lab preserved prior files, removing it restores the previous configuration combination, not deleted historical logs.

sudo rm -- /etc/systemd/journald.conf.d/60-lab-retention.conf && sudo systemctl restart systemd-journald.service && sudo journalctl --flush
sudo systemd-analyze cat-config systemd/journald.conf

Run logrotate on disposable files

With logrotate installed, the following Bash block uses a new home-directory lab and separate state file. It leaves system rotation state and real application logs alone. Run the full block and keep the printed folder path.

work=$(mktemp -d "$HOME/logrotate-lab.XXXXXX")
for i in {1..200}; do printf 'lab line %04d\n' "$i"; done > "$work/app.log"
cat > "$work/logrotate.conf" <<EOF
"$work/app.log" {
    size 1k
    rotate 2
    compress
    missingok
    notifempty
    create 0600
}
EOF
logrotate -d -s "$work/state" "$work/logrotate.conf"
logrotate -s "$work/state" "$work/logrotate.conf"
ls -l "$work"
printf 'Lab folder: %s\n' "$work"

Debug mode previews the plan; the second command rotates. Inspect the new app.log and compressed archive, then use gzip -cd "$work/app.log.1.gz" to read retained practice lines. Real applications may keep an open descriptor and need documented postrotate or reload handling.

Verify restoration and retained history

Restore only the journal drop-in changed for the lab and reapply settings. Restoring policy does not recover logs already deleted; independent archives are required. Review the lab folder and remove only files created for this exercise.

Document capacity, duration, authorized readers, sensitive-data handling, and failure detection together. Verify service responses, generation, searching, and readability after rotation as separate outcomes.

Ubuntu