Journald

Links

• How To Use Journalctl to View and Manipulate Systemd Logs

HOWTO

Limit journal log size

journalctl --vacuum-time=10d

or

journalctl --vacuum-size=1G

Journal settings

/etc/systemd/journald.conf

SystemMaxUse=1G

and then

systemctl restart systemd-journald.service

tail a journal log

journalctl -u sshguard -f