Hi @mike212916,

I doubt you can effectively control how much RAM journald is using. I would take a serious look at whats creating all of those logs.

What do you see happening in the journal if you browse it? You can check your current boot’s messages with journalctl -b and you can have journalctl follow and print new messages as they happen with journalctl -f.

There are a lot of possibilities so this would need to be investigated and providing you with a pinpoint answer is impossible.

Apart of the above commands however, you can try using journalctl -xe it will show you the last lines of the log.

Regards,
KDSys

You may find the following useful (at least, those answers helped me):

https://bbs.archlinux.org/viewtopic.php?id=190200
https://github.com/systemd/systemd/issues/9141

Note, in particular, that “journald uses mmap for its journal IO, and it caches these mappings to keep things quick. The style of mapping is MAP_SHARED, which means these can be evicted/paged out by the kernel when memory is required.”, so the RES size may not be as bad as one may think.

Mike