Amend "Journal has been rotated since unit was started..."

Summary

systemctl status xxx shows the message:

Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.

The cause

In my case, the disk usage of the log files for journald was maxed out.

• du -sh /run/log/journal let you see the disk usage.

• The default maximum usage is 10% of the disk size.

  • It depends on your situation, but if /run is in a different partition from the one for /, you must refer the disk size for /run instead.

Amendment

Step 1

Amend the file /etc/systemd/journald.conf.

• SystemMaxUse for /var/log/journal.

  • My machine did not have the directory so I did not apply this setting.

• RuntimeMaxUse for /run/log/journal.
  
  

/etc/systemd/journald.conf
==========
SystemMaxUse=100M
RuntimeMaxUse=100M

Step 2

Shrink the disk usage by deleting old archived log files:

journalctl --vacuum-time=2weeks
# OR
journalctl --vacuum-size=20M

Step 3

Restart journald.

I am actually not sure if it is OK to use systemctl restart as it may lose some logs, but I could not have found a better way (Restart instead?):

journalctl --rotate && \
systemctl restart systemd-journald

Useful Commands

journalctl --disk-usage
# OR
du -sh /run/log/journal

journalctl --verify

ls -l /run/log/journal/*

systemctl status systemd-journald

References

• How can I see previous logs with systemd?

• journalctl log file size

• systemd/Journal

• How to tell journald to re-read its configuration?

• How to clear journalctl