{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/account-for-active-files-when-estimating-journal-vacuum-results/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/account-for-active-files-when-estimating-journal-vacuum-results/",
        "slug": "account-for-active-files-when-estimating-journal-vacuum-results",
        "url": "https://update.dsesecurity.com/updates/account-for-active-files-when-estimating-journal-vacuum-results/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/account-for-active-files-when-estimating-journal-vacuum-results.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/account-for-active-files-when-estimating-journal-vacuum-results/"
        },
        "title": "Account for active files when estimating journal vacuum results",
        "summary": "A vacuum limit applies to archived journal files rather than the entire disk-usage display.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "managed-it",
            "label": "Managed IT operations",
            "alt": "A controlled technology lifecycle progressing from assessment to approved production.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:15:29+00:00",
        "modified_at": "2026-10-20T18:34:33+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 259,
        "potentially_affected": "Review journalctl archived-file vacuum limits and rotation using the Debian trixie manual.",
        "dse_recommendation": "DSE recommends preserving incident evidence and confirming retention obligations before vacuuming.",
        "primary_source": {
            "name": "Debian systemd manual — journalctl(1) — systemd — Debian trixie — Debian Manpages",
            "url": "https://manpages.debian.org/trixie/systemd/journalctl.1.en.html",
            "published_on": null,
            "authority": "manpages.debian.org"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A vacuum limit applies to archived journal files rather than the entire disk-usage display.</p>\n<h2>Source facts</h2>\n<p>The Debian journalctl manual states that <code>--disk-usage</code> includes active and archived journal files. Vacuum options remove archived files, so their size or file-count target may not reduce total displayed use below that value. Combining rotation with vacuum first archives active files, making more existing data eligible for the requested cleanup.</p>\n<p>Source: <a href=\"https://manpages.debian.org/trixie/systemd/journalctl.1.en.html\">Debian systemd manual — journalctl(1) — systemd — Debian trixie — Debian Manpages</a>.</p>\n<h2>Applicability</h2>\n<p>Review journalctl archived-file vacuum limits and rotation using the Debian trixie manual.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends preserving incident evidence and confirming retention obligations before vacuuming. Explain the difference between active and archived use when estimating reclaimed space. Prefer documented journal controls over deleting files manually. Keep emergency cleanup distinct from a lasting size policy, and investigate why the journal grew unexpectedly. If rotation is needed, review its effect on the data eligible for deletion rather than adding it blindly to a disk-space command copied from another server.</p>\n<h2>Verification</h2>\n<p>In an isolated journal store, compare disk usage, active files, and archived files before a safe retention exercise. Apply only an approved test limit and inspect the result. Confirm expected historical queries still work through the retained archive and that production monitoring uses the correct total-space interpretation. Retain the active/archived file inventory and exact requested limit with the result. Have the log owner approve the historical interval retained in the exercise and explain any remaining active-file contribution to total use.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://manpages.debian.org/trixie/systemd/journalctl.1.en.html\">Debian systemd manual — journalctl(1) — systemd — Debian trixie — Debian Manpages</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A vacuum limit applies to archived journal files rather than the entire disk-usage display.\nSource facts\nThe Debian journalctl manual states that --disk-usage includes active and archived journal files. Vacuum options remove archived files, so their size or file-count target may not reduce total displayed use below that value. Combining rotation with vacuum first archives active files, making more existing data eligible for the requested cleanup.\nSource: Debian systemd manual — journalctl(1) — systemd — Debian trixie — Debian Manpages.\nApplicability\nReview journalctl archived-file vacuum limits and rotation using the Debian trixie manual.\nDSE recommendation\nDSE recommends preserving incident evidence and confirming retention obligations before vacuuming. Explain the difference between active and archived use when estimating reclaimed space. Prefer documented journal controls over deleting files manually. Keep emergency cleanup distinct from a lasting size policy, and investigate why the journal grew unexpectedly. If rotation is needed, review its effect on the data eligible for deletion rather than adding it blindly to a disk-space command copied from another server.\nVerification\nIn an isolated journal store, compare disk usage, active files, and archived files before a safe retention exercise. Apply only an approved test limit and inspect the result. Confirm expected historical queries still work through the retained archive and that production monitoring uses the correct total-space interpretation. Retain the active/archived file inventory and exact requested limit with the result. Have the log owner approve the historical interval retained in the exercise and explain any remaining active-file contribution to total use.\nOfficial reference\nDebian systemd manual — journalctl(1) — systemd — Debian trixie — Debian Manpages. Reviewed October 20, 2026.",
        "content_markdown": "A vacuum limit applies to archived journal files rather than the entire disk-usage display.\n\n## Source facts\n\nThe Debian journalctl manual states that --disk-usage includes active and archived journal files. Vacuum options remove archived files, so their size or file-count target may not reduce total displayed use below that value. Combining rotation with vacuum first archives active files, making more existing data eligible for the requested cleanup.\n\nSource: [Debian systemd manual — journalctl(1) — systemd — Debian trixie — Debian Manpages](https://manpages.debian.org/trixie/systemd/journalctl.1.en.html).\n\n## Applicability\n\nReview journalctl archived-file vacuum limits and rotation using the Debian trixie manual.\n\n## DSE recommendation\n\nDSE recommends preserving incident evidence and confirming retention obligations before vacuuming. Explain the difference between active and archived use when estimating reclaimed space. Prefer documented journal controls over deleting files manually. Keep emergency cleanup distinct from a lasting size policy, and investigate why the journal grew unexpectedly. If rotation is needed, review its effect on the data eligible for deletion rather than adding it blindly to a disk-space command copied from another server.\n\n## Verification\n\nIn an isolated journal store, compare disk usage, active files, and archived files before a safe retention exercise. Apply only an approved test limit and inspect the result. Confirm expected historical queries still work through the retained archive and that production monitoring uses the correct total-space interpretation. Retain the active/archived file inventory and exact requested limit with the result. Have the log owner approve the historical interval retained in the exercise and explain any remaining active-file contribution to total use.\n\n## Official reference\n\n[Debian systemd manual — journalctl(1) — systemd — Debian trixie — Debian Manpages](https://manpages.debian.org/trixie/systemd/journalctl.1.en.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/account-for-active-files-when-estimating-journal-vacuum-results/",
                "url": "https://update.dsesecurity.com/updates/account-for-active-files-when-estimating-journal-vacuum-results/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/account-for-active-files-when-estimating-journal-vacuum-results/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "IT",
                        "item": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Account for active files when estimating journal vacuum results",
                        "item": "https://update.dsesecurity.com/updates/account-for-active-files-when-estimating-journal-vacuum-results/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/account-for-active-files-when-estimating-journal-vacuum-results/#article",
                "identifier": "https://update.dsesecurity.com/updates/account-for-active-files-when-estimating-journal-vacuum-results/",
                "url": "https://update.dsesecurity.com/updates/account-for-active-files-when-estimating-journal-vacuum-results/",
                "headline": "Account for active files when estimating journal vacuum results",
                "description": "A vacuum limit applies to archived journal files rather than the entire disk-usage display.",
                "abstract": "A vacuum limit applies to archived journal files rather than the entire disk-usage display.",
                "articleBody": "A vacuum limit applies to archived journal files rather than the entire disk-usage display.\nSource facts\nThe Debian journalctl manual states that --disk-usage includes active and archived journal files. Vacuum options remove archived files, so their size or file-count target may not reduce total displayed use below that value. Combining rotation with vacuum first archives active files, making more existing data eligible for the requested cleanup.\nSource: Debian systemd manual — journalctl(1) — systemd — Debian trixie — Debian Manpages.\nApplicability\nReview journalctl archived-file vacuum limits and rotation using the Debian trixie manual.\nDSE recommendation\nDSE recommends preserving incident evidence and confirming retention obligations before vacuuming. Explain the difference between active and archived use when estimating reclaimed space. Prefer documented journal controls over deleting files manually. Keep emergency cleanup distinct from a lasting size policy, and investigate why the journal grew unexpectedly. If rotation is needed, review its effect on the data eligible for deletion rather than adding it blindly to a disk-space command copied from another server.\nVerification\nIn an isolated journal store, compare disk usage, active files, and archived files before a safe retention exercise. Apply only an approved test limit and inspect the result. Confirm expected historical queries still work through the retained archive and that production monitoring uses the correct total-space interpretation. Retain the active/archived file inventory and exact requested limit with the result. Have the log owner approve the historical interval retained in the exercise and explain any remaining active-file contribution to total use.\nOfficial reference\nDebian systemd manual — journalctl(1) — systemd — Debian trixie — Debian Manpages. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:15:29+00:00",
                "dateModified": "2026-10-20T18:34:33+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/account-for-active-files-when-estimating-journal-vacuum-results/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/account-for-active-files-when-estimating-journal-vacuum-results/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Account for active files when estimating journal vacuum results"
                },
                "articleSection": [
                    "IT",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "IT",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 259,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Debian systemd manual — journalctl(1) — systemd — Debian trixie — Debian Manpages",
                    "url": "https://manpages.debian.org/trixie/systemd/journalctl.1.en.html"
                }
            }
        ]
    }
}