Loading...

VONDS ©

Lab 143: Journal Cleanup & Printing Workflow

Back to Lab Index

Cap runaway journal growth by vacuuming logs to a target size, review entries since a specific time, identify the persistent disk-usage cap key in journald.conf, then triage a Postfix queue backlog by inspecting the queue and confirming the spool location. Finish with a CUPS print-path validation: submit a test job, verify the queue, and clean up the job safely.

journald postfix printing

Scenario

The journal grew too large overnight and Ops wants it capped quickly. There is also a mail queue backlog to inspect and a printer test job to submit.

Safety note

Journal vacuuming removes archived logs. In real incidents you would confirm retention requirements before aggressive cleanup. This lab focuses on controlled commands and verification.

Objective

  • Reduce journal disk usage to a target cap using journalctl --vacuum-size.
  • Query the journal starting at a specific time using journalctl --since.
  • Identify the persistent storage cap key (SystemMaxUse) in journald.conf.
  • Inspect the Postfix queue and confirm the spool/queue directory with postconf.
  • Submit a test print to a named destination, verify the queue, then cancel and confirm cleanup.

Concepts

  • Journal cleanup using journalctl --vacuum-size removes older archived segments until the size target is met.
  • Time-scoped log review using journalctl --since helps narrow incident windows.
  • Persistent retention control lives in journald.conf via keys like SystemMaxUse=.
  • Postfix triage starts with the queue view (mailq) and validating the effective spool path (postconf).
  • Printing validation is a simple loop: submit (lp), confirm (lpstat), then clean up (cancel).

Walkthrough

Step 1: Vacuum the journal to a fixed size cap.
Command 
sudo journalctl --vacuum-size=200M

This reduces on-disk journal usage by removing older archived segments until the target size is met. 

Vacuuming done, freed 42.3M of archived journals on disk.
Step 2: Show entries since 09:00 today.
Command 
journalctl --since 'today 09:00'

Time-scoped queries let you narrow your review window to the relevant change period. 

Jan 25 09:01:12 lab143 kernel: eth0: Link is Up 1000 Mbps Full Duplex
Jan 25 09:05:44 lab143 sshd[1324]: Accepted publickey for admin from 192.0.2.50 port 51522 ssh2
Step 3: Identify the persistent journal cap key.
Command 
man journald.conf | grep -n SystemMaxUse | head -n 1

SystemMaxUse= is the configuration key that caps total persistent journal size on disk. 

164:SystemMaxUse=
Step 4: Inspect the Postfix mail queue.
Command 
mailq

This shows queued mail, recipients, and common failure reasons (timeouts, DNS failures, relay issues). 

-Queue ID-  --Size-- ----Arrival Time---- -Sender/Recipient-------
9F1D2C3B4A*     2104 Sun Jan 25 06:22:10  reports@example.com
                                       ops@example.com
                                       (connect to mx.example.com[203.0.113.25]:25: Connection timed out)
2A7B8C9D0E      1189 Sun Jan 25 06:41:33  root@lab143
                                       admin@example.com
-- 4 Kbytes in 2 Requests.
Step 5: Show the Postfix queue directory.
Command 
postconf queue_directory

Use postconf to query effective configuration values without opening config files. 

queue_directory = /var/spool/postfix
Step 6: Verify the spool directory exists.
Command 
ls -ld /var/spool/postfix

This is a quick sanity check: if the spool directory is missing or mis-permissioned, queues will break. 

drwxr-xr-x. 20 root root 4096 Jan 25 06:02 /var/spool/postfix
Step 7: Submit a test print job to a specific destination.
Command 
lp -d office /etc/hosts

Using -d targets a known printer name directly. This makes the test deterministic. 

request id is office-17 (1 file(s))
Step 8: Verify the print queue shows the job.
Command 
lpstat -o

Confirm the job is visible so you know the submission succeeded. 

office-17  lab  1024  Sun 25 Jan 2026 07:28:11 AM EST
Step 9: Cancel the job (cleanup).
Command 
cancel office-17

In a lab environment, you want to leave the queue clean after validating behavior.

Step 10: Confirm the queue is empty.
Command 
lpstat -o

The expected signal after cleanup is a queue with no entries.

no entries

Common breakpoints

journalctl --vacuum-size does not free much

You may already be below the target size or most of the disk usage is active journals. Check usage with journalctl --disk-usage and confirm whether persistent storage is enabled.

--since query returns “no entries”

Confirm the system clock is correct and the time window makes sense. If the host is in a different time zone, include a full timestamp (date and time) for clarity.

mailq shows timeouts to a relay

Queue growth may be a network path problem or a remote MTA issue. As a first pass, confirm DNS and route reachability before deleting messages.

lp fails: “unknown destination”

The printer name must match a configured destination. List printers with lpstat -p -d and use an existing name.

cancel fails: “job not found”

The job may have completed or you targeted the wrong ID. Re-run lpstat -o and retry with the exact job ID.

Cleanup checklist

The goal is to leave the host stable: journal usage capped, mail queue inspected, and the print queue empty.

Commands 
journalctl --disk-usage
mailq || postqueue -p
lpstat -o || true
Final verification signal

Journal usage is within expectations, mailq output is understood (no surprises), and lpstat -o reports no entries.

Reference

  • journalctl --vacuum-size=<size>: remove older archived journal data until total usage is under the target.
    • --vacuum-size=200M: example size cap.
  • journalctl --since <time>: query journal entries starting at a specific time.
    • --since 'today 09:00': example time window.
  • man journald.conf: documentation for journald configuration.
  • SystemMaxUse=: journald.conf key that caps total persistent journal disk usage.
  • mailq: display the Postfix mail queue and delivery status.
  • postqueue -p: print the Postfix queue (alternate to mailq).
    • -p: prints the queue.
  • postconf queue_directory: show the effective Postfix spool directory.
  • ls -ld /var/spool/postfix: verify the spool directory exists and check permissions.
    • -l: long listing.
    • -d: list the directory itself, not its contents.
  • lp -d <printer> <file>: submit a print job to a specific destination.
    • -d <printer>: selects the destination printer.
  • lpstat -o: show queued print jobs.
    • -o: shows outstanding jobs.
  • cancel <jobid>: cancel a specific print job.
  • journalctl --disk-usage: show current journal disk usage.