Can I remove files in /var/log/journal and /var/cache/abrt-di/usr?

journal logs

Yes you can delete everything inside of /var/log/journal/* but do not delete the directory itself. You can also query journalctl to find out how much disk space it's consuming:

$ journalctl --disk-usage
Journals take up 3.8G on disk.

You can control the size of this directory using this parameter in your /etc/systemd/journald.conf:

SystemMaxUse=50M

You can force a log rotation:

$ sudo systemctl kill --kill-who=main --signal=SIGUSR2 systemd-journald.service

NOTE: You might need to restart the logging service to force a log rotation, if the above signaling method does not do it. You can restart the service like so:

$ sudo systemctl restart systemd-journald.service

abrt logs

These files too under /var/cache/abrt-di/* can be deleted as well. The size of the log files here is controlled under:

$ grep -i size /etc/abrt/abrt.conf 
# Max size for crash storage [MiB] or 0 for unlimited
MaxCrashReportsSize = 1000

You can control the max size of /var/cache/abrt-di by changing the following in file, /etc/abrt/plugins/CCpp.conf:

DebugInfoCacheMB = 2000

NOTE: If not defined DebugInfoCacheMB defaults to 4000 (4GB).

References

  • Is it safe to delete /var/log/journal log files?
  • Surprising behaviour when out of disk space
  • 19.4. Generating Backtraces

Yes, the files from /var/log/journal directory can be removed.

The most nice method I've found is:

journalctl --vacuum-size=500M

which deletes old log-files from /var/log/journal until total size of the directory becomes under specified threshold (500 megabytes in this example).


You can also clean based on time: journalctl --vacuum-time=10d

# du -sh /var/log/journal
113M    /var/log/journal
# journalctl --vacuum-time=10d
Deleted archived journal /var/log/journal/f77f9567bb70f8e7b5d9a0c95bef5c2a/system@36170b4530af4c89ac4d84ac68f8b727-0000000000000001-00057b09da23eb2c.journal (8.0M).
Deleted archived journal /var/log/journal/f77f9567bb70f8e7b5d9a0c95bef5c2a/user-1000@54176301a0c74c4698c3b6a549e1b2ed-0000000000000874-00057b0c1a491094.journal (8.0M).
. . .
Deleted archived journal /var/log/journal/f77f9567bb70f8e7b5d9a0c95bef5c2a/user-1000@e6ecd2f858d1498b9a445af7bac00bbf-000000000000063a-0005848ac99802b3.journal (8.0M).
Vacuuming done, freed 88.0M of archived journals from /var/log/journal/f77f9567bb70f8e7b5d9a0c95bef5c2a.
root@monroe:/var/log# du -sh /var/log/journal     
25M     /var/log/journal