When I issue journalctl I get a massive log of all system services, but where is all this information stored?
4 Answers
From man systemd-journald:
FILES
/etc/systemd/journald.conf
Configure systemd-journald behavior. See journald.conf(5).
/run/log/journal/machine-id/*.journal,
/run/log/journal/machine-id/*.journal~,
/var/log/journal/machine-id/*.journal,
/var/log/journal/machine-id/*.journal~
systemd-journald writes entries to files in
/run/log/journal/machine-id/ or /var/log/journal/machine-id/ with
the ".journal" suffix. If the daemon is stopped uncleanly, or if
the files are found to be corrupted, they are renamed using the
".journal~" suffix, and systemd-journald starts writing to a new
file. /run is used when /var/log/journal is not available, or when
Storage=volatile is set in the journald.conf(5) configuration file.
And as man journalctl says:
journalctl may be used to query the contents of the systemd(1) journal
as written by systemd-journald.service(8).
These logs are managed by the systemd-journald service, so a more appropriate term would be "journald logs".
Note however that Ubuntu is not using a persistent journald log file by default. Only the volatile /run/log/journal/<machine-id>/*.journal[~] is kept until the next boot. All is lost at each reboot.
You may see a list of boot retained in the log with:
journalctl --list-boot
The logs are still kept in a text file under /var/log unless you have activated the use of persistent journald log by creating /var/log/journal directory.
Short answer
Usually the storage directory is /var/log/journal or /run/log/journal, but it doesn't have to necessarily exist in your system.
If you just want to check the amount of space that the journal is currently occupying on your disk, simply type:
$ journalctl --disk-usage
