Il y a un géant dans mon ordi...

Je pense avoir un souci.
Comment investiguer ?

➜  ~ journalctl --disk-usage
Archived and active journals take up 3.5G in the file system.
➜  ~

alors pour cela il y a 2 commandes

gestion par taille maximum

sudo journalctl --vacuum-size=

ou gestion par date maximum

sudo journalctl --vacuum-time=

les options sont les suivantes ( issu de man journalctl )

--disk-usage
           Shows the current disk usage of all journal files. This shows the
           sum of the disk usage of all archived and active journal files.

       --vacuum-size=, --vacuum-time=, --vacuum-files=
           Removes the oldest archived journal files until the disk space they
           use falls below the specified size (specified with the usual "K",
           "M", "G" and "T" suffixes), or all archived journal files contain
           no data older than the specified timespan (specified with the usual
           "s", "m", "h", "days", "months", "weeks" and "years" suffixes), or
           no more than the specified number of separate journal files remain.
           Note that running --vacuum-size= has only an indirect effect on the
           output shown by --disk-usage, as the latter includes active journal
           files, while the vacuuming operation only operates on archived
           journal files. Similarly, --vacuum-files= might not actually reduce
           the number of journal files to below the specified number, as it
           will not remove active journal files.

           --vacuum-size=, --vacuum-time= and --vacuum-files= may be combined
           in a single invocation to enforce any combination of a size, a time
           and a number of files limit on the archived journal files.
           Specifying any of these three parameters as zero is equivalent to
           not enforcing the specific limit, and is thus redundant.

           These three switches may also be combined with --rotate into one
           command. If so, all active files are rotated first, and the
           requested vacuuming operation is executed right after. The rotation
           has the effect that all currently active files are archived (and
           potentially new, empty journal files opened as replacement), and
           hence the vacuuming operation has the greatest effect as it can
           take all log data written so far into account.

bonjour

Il faudrait déjà regarder si ton journal n'est pas envahi de "spam" (ou de "coredump")

sinon le réduire pour avoir 99% de spam n'est pas top.

Il est possible de régler la taille de notre journal par différents procédés :
dossier /etc/systemd/journald.conf.d/ (peut être a créer)
créer un fichier de config (nom libre) /etc/systemd/journald.conf.d/size.conf
Un exemple

[Journal]
# taille du journald est de 300M sur un seul fichier
SystemMaxUse=300M
SystemMaxFileSize=300M
#on ne garde que 2 mois d'historique (si désire plus: 1year, ou moins: 15day)
MaxRetentionSec=2month

#niveau maximum à enregistrer
# "emerg", "alert", "crit", "err", "warning", "notice", "info", "debug"
MaxLevelStore=warning

Audit=off

si on utilise MaxRetentionSec un peu serré, normalement les SystemMax___ n'est pas utile (avoir les 2, c'est bretelles et ceinture

)
avec MaxLevelStore, ici on ne garde que les erreurs donc la taille devrait-être petite même pour 3 mois.

-------------------

Note: avec la prochaine version de systemd (pas encore dans manjaro unstable), nous pouvons ENFIN faire des filtres sur ce que nous ne sauvegardons pas. Filtres pas top (manque le level) mais c'est déjà un bon début.

par exemple ... avec ma kde (version 253 arrivée hier chez arch)

# /etc/systemd/system/user@.service.d/30-journalfilter.conf
[Service]
# ne pas sauvegarder les messages qui contiennent ces mots
LogFilterPatterns=~QML
LogFilterPatterns=~Qml
LogFilterPatterns=~qml
LogFilterPatterns=~org\.kde\.plasma
LogFilterPatterns=~QObject:
LogFilterPatterns=~QFont::

le man de cette nouvelle fonctionnalité:

LogFilterPatterns=
Define an extended regular expression to filter log messages based on the MESSAGE= field of the structured message. If the first character of the pattern is "~", log entries matching the pattern should be discarded. This option takes a single pattern as an argument but can be used multiple times to create a list of allowed and denied patterns. If the empty string is assigned, the filter is reset, and all prior assignments will have no effect.

Because the "~" character is used to define denied patterns, it must be replaced with "\x7e" to allow a message starting with "~". For example, "~foobar" would add a pattern matching "foobar" to the deny list, while "\x7efoobar" would add a pattern matching "~foobar" to the allow list.

Log messages are tested against denied patterns (if any), then against allowed patterns (if any). If a log message matches any of the denied patterns, it will be discarded, whatever the allowed patterns. Then, remaining log messages are tested against allowed patterns. Messages matching against none of the allowed pattern are discarded. If no allowed patterns are defined, then all messages are processed directly after going through denied filters.

Filtering is based on the unit for which LogFilterPatterns= is defined, meaning log messages coming from systemd(1) about the unit are not taken into account. Filtered log messages won't be forwarded to traditional syslog daemons, the kernel log buffer (kmsg), the systemd console, or sent as wall messages to all logged-in users.

Merci pour vos idées.

Avant de réduire, je cherche à voir si il y a des soucis récurrents

➜  ~ journalctl -b -3 | grep "rror"
févr. 19 16:11:37 402 kernel: RAS: Correctable Errors collector initialized.
févr. 19 16:11:37 402 systemd[1]: Starting Monitoring of LVM2 mirrors, snapshots etc. using dmeventd or progress polling...
févr. 19 16:11:37 402 systemd[1]: Finished Monitoring of LVM2 mirrors, snapshots etc. using dmeventd or progress polling.
févr. 19 16:11:38 402 systemd[1]: Started Generate mirrorlist weekly.
févr. 19 16:11:39 402 libvirtd[800]: internal error: Failed to autostart storage pool 'pool': cannot open directory '/home/sum/Téléchargements/Iso': Aucun fichier ou dossier de ce type
févr. 19 16:11:45 402 bluetooth-autoconnect[898]: error connecting to device /org/bluez/hci0/dev_6F_0C_24_C6_5B_C3: br-connection-create-socket
févr. 19 16:11:47 402 dockerd[1094]: time="2023-02-19T16:11:47.104211324+01:00" level=info msg="skip loading plugin \"io.containerd.snapshotter.v1.aufs\"..." error="aufs is not supported (modprobe aufs failed: exit status 1 \"modprobe: FATAL: Module aufs not found in directory /lib/modules/6.1.11-1-MANJARO\\n\"): skip plugin" type=io.containerd.snapshotter.v1
févr. 19 16:11:47 402 dockerd[1094]: time="2023-02-19T16:11:47.104300351+01:00" level=info msg="skip loading plugin \"io.containerd.snapshotter.v1.btrfs\"..." error="path /var/lib/docker/containerd/daemon/io.containerd.snapshotter.v1.btrfs (ext4) must be a btrfs filesystem to be used with the btrfs snapshotter: skip plugin" type=io.containerd.snapshotter.v1
févr. 19 16:11:47 402 dockerd[1094]: time="2023-02-19T16:11:47.104317113+01:00" level=warning msg="failed to load plugin io.containerd.snapshotter.v1.devmapper" error="devmapper not configured"
févr. 19 16:11:47 402 dockerd[1094]: time="2023-02-19T16:11:47.105264199+01:00" level=info msg="skip loading plugin \"io.containerd.snapshotter.v1.zfs\"..." error="path /var/lib/docker/containerd/daemon/io.containerd.snapshotter.v1.zfs must be a zfs filesystem to be used with the zfs snapshotter: skip plugin" type=io.containerd.snapshotter.v1
févr. 19 16:11:47 402 dockerd[1094]: time="2023-02-19T16:11:47.105286391+01:00" level=warning msg="could not use snapshotter devmapper in metadata plugin" error="devmapper not configured"
févr. 19 16:11:47 402 dockerd[1094]: time="2023-02-19T16:11:47.109804676+01:00" level=info msg="skip loading plugin \"io.containerd.tracing.processor.v1.otlp\"..." error="no OpenTelemetry endpoint: skip plugin" type=io.containerd.tracing.processor.v1
févr. 19 16:11:47 402 dockerd[1094]: time="2023-02-19T16:11:47.109831035+01:00" level=error msg="failed to initialize a tracing processor \"otlp\"" error="no OpenTelemetry endpoint: skip plugin"
févr. 19 16:12:04 402 bluetooth-autoconnect[898]: error connecting to device /org/bluez/hci0/dev_F4_4D_92_5D_3C_12: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
févr. 19 16:12:09 402 systemd-xdg-autostart-generator[1632]: /home/sum/.config/autostart/cerebro.desktop: not generating unit, error parsing Exec= line: No such file or directory
févr. 19 16:12:09 402 systemd-xdg-autostart-generator[1632]: /home/sum/.config/autostart/lbry-app.desktop: not generating unit, error parsing Exec= line: No such file or directory
févr. 19 16:12:10 402 wireplumber[1736]: <WpPortalPermissionStorePlugin:0x55b8dfc06f90> Failed to call Lookup: GDBus.Error:org.freedesktop.portal.Error.NotFound: No entry for camera
févr. 19 16:12:10 402 wireplumber[1736]: <WpPortalPermissionStorePlugin:0x55b8dfc06f90> Failed to call Lookup: GDBus.Error:org.freedesktop.portal.Error.NotFound: No entry for camera

➜  ~ journalctl -b -3 | grep "dump"
févr. 19 16:12:17 402 appimagelauncherd[1639]: Scheduling for unintegration: /home/sum/.zcompdump-402-5.9.lock
févr. 19 16:28:34 Error404 systemd[1]: systemd-coredump.socket: Deactivated successfully.
févr. 19 16:28:34 Error404 systemd-coredump[5508]: Failed to connect to coredump service: Connection refused
févr. 19 16:28:35 Error404 systemd[1]: udisks2.service: Main process exited, code=dumped, status=6/ABRT
févr. 19 16:28:35 Error404 systemd[1]: udisks2.service: Failed with result 'core-dump'.
➜  ~

➜  ~ journalctl -b -3 | grep "fail"
févr. 19 16:11:37 402 systemd[337]: /usr/lib/systemd/system-generators/podman-system-generator failed with exit status 1.
févr. 19 16:11:37 402 kernel: vboxdrv: module verification failed: signature and/or required key missing - tainting kernel
févr. 19 16:11:39 402 bluetoothd[903]: src/service.c:btd_service_connect() a2dp-sink profile connect failed for 6F:0C:24:C6:5B:C3: Protocol not available
févr. 19 16:11:40 402 dbus-daemon[763]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
févr. 19 16:11:40 402 audit[961]: CRED_ACQ pid=961 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=? acct="lightdm" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
févr. 19 16:11:40 402 systemd[966]: /usr/lib/systemd/user-generators/podman-user-generator failed with exit status 1.
févr. 19 16:11:40 402 dbus-daemon[763]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
févr. 19 16:11:44 402 dbus-daemon[763]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.resolve1.service': Unit dbus-org.freedesktop.resolve1.service not found.
févr. 19 16:11:45 402 nextdns[801]: Endpoint provider failed: &{dns.nextdns.io https://dns.nextdns.io#45.90.28.0,2a07:a8c0::,45.90.30.0,2a07:a8c1::}: exchange: roundtrip: dial tcp 45.90.30.0:443: connect: network is unreachable
févr. 19 16:11:45 402 nextdns[801]: Endpoint failed: https://dns1.nextdns.io#45.90.28.0,2a07:a8c0::: roundtrip: dial tcp 45.90.28.0:443: connect: network is unreachable
févr. 19 16:11:45 402 nextdns[801]: Endpoint failed: https://dns2.nextdns.io#45.90.30.0,2a07:a8c1::: roundtrip: dial tcp 45.90.30.0:443: connect: network is unreachable
févr. 19 16:11:47 402 dockerd[1094]: time="2023-02-19T16:11:47.104211324+01:00" level=info msg="skip loading plugin \"io.containerd.snapshotter.v1.aufs\"..." error="aufs is not supported (modprobe aufs failed: exit status 1 \"modprobe: FATAL: Module aufs not found in directory /lib/modules/6.1.11-1-MANJARO\\n\"): skip plugin" type=io.containerd.snapshotter.v1
févr. 19 16:11:47 402 dockerd[1094]: time="2023-02-19T16:11:47.104317113+01:00" level=warning msg="failed to load plugin io.containerd.snapshotter.v1.devmapper" error="devmapper not configured"
févr. 19 16:11:47 402 dockerd[1094]: time="2023-02-19T16:11:47.109831035+01:00" level=error msg="failed to initialize a tracing processor \"otlp\"" error="no OpenTelemetry endpoint: skip plugin"
févr. 19 16:12:08 402 kernel: audit: type=1100 audit(1676819528.906:124): pid=1012 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication grantors=pam_shells,pam_faillock,pam_permit,pam_faillock,pam_gnome_keyring acct="sum" exe="/usr/bin/lightdm" hostname=? addr=? terminal=:0 res=success'
févr. 19 16:12:08 402 audit[1012]: USER_AUTH pid=1012 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication grantors=pam_shells,pam_faillock,pam_permit,pam_faillock,pam_gnome_keyring acct="sum" exe="/usr/bin/lightdm" hostname=? addr=? terminal=:0 res=success'
févr. 19 16:12:08 402 audit[1012]: CRED_ACQ pid=1012 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_shells,pam_faillock,pam_permit,pam_faillock,pam_gnome_keyring acct="sum" exe="/usr/bin/lightdm" hostname=? addr=? terminal=:0 res=success'
févr. 19 16:12:08 402 kernel: audit: type=1103 audit(1676819528.966:128): pid=1012 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_shells,pam_faillock,pam_permit,pam_faillock,pam_gnome_keyring acct="sum" exe="/usr/bin/lightdm" hostname=? addr=? terminal=:0 res=success'
févr. 19 16:12:09 402 dbus-daemon[763]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
févr. 19 16:12:09 402 audit[1625]: CRED_ACQ pid=1625 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=? acct="sum" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
févr. 19 16:12:09 402 systemd-xdg-autostart-generator[1632]: /home/sum/.config/autostart/safeeyes.desktop: stat() failed, ignoring: No such file or directory
févr. 19 16:12:09 402 systemd[1630]: /usr/lib/systemd/user-generators/podman-user-generator failed with exit status 1.
févr. 19 16:12:38 402 dbus-daemon[763]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
févr. 19 16:12:43 402 audit[2815]: USER_AUTH pid=2815 uid=1000 auid=1000 ses=2 msg='op=PAM:authentication grantors=pam_faillock,pam_permit,pam_faillock acct="sum" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
févr. 19 16:12:43 402 audit[2815]: CRED_REFR pid=2815 uid=1000 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
févr. 19 16:12:43 402 kernel: audit: type=1100 audit(1676819563.531:153): pid=2815 uid=1000 auid=1000 ses=2 msg='op=PAM:authentication grantors=pam_faillock,pam_permit,pam_faillock acct="sum" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
févr. 19 16:12:43 402 kernel: audit: type=1110 audit(1676819563.531:155): pid=2815 uid=1000 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
févr. 19 16:12:43 Error404 audit[2815]: CRED_DISP pid=2815 uid=1000 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
févr. 19 16:26:25 Error404 NetworkManager[777]: <info>  [1676820385.4356] device (wlo1): state change: activated -> failed (reason 'ssid-not-found', sys-iface-state: 'managed')
févr. 19 16:26:25 Error404 NetworkManager[777]: <warn>  [1676820385.5479] device (wlo1): Activation: failed for connection 'L8_Box'
févr. 19 16:26:25 Error404 NetworkManager[777]: <info>  [1676820385.5487] device (wlo1): state change: failed -> disconnected (reason 'none', sys-iface-state: 'managed')
févr. 19 16:27:08 Error404 wpa_supplicant[936]: wlo1: CTRL-EVENT-SSID-TEMP-DISABLED id=0 ssid="L8_Box" auth_failures=1 duration=10 reason=CONN_FAILED
févr. 19 16:28:34 Error404 audit[1012]: CRED_DISP pid=1012 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_shells,pam_faillock,pam_permit,pam_faillock,pam_gnome_keyring acct="sum" exe="/usr/bin/lightdm" hostname=? addr=? terminal=:0 res=success'
févr. 19 16:28:34 Error404 kernel: audit: type=1104 audit(1676820514.482:183): pid=1012 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_shells,pam_faillock,pam_permit,pam_faillock,pam_gnome_keyring acct="sum" exe="/usr/bin/lightdm" hostname=? addr=? terminal=:0 res=success'
févr. 19 16:28:34 Error404 udisksd[2008]: GLib-GIO:ERROR:../glib/gio/gresource.c:1451:g_static_resource_fini: assertion failed: (g_atomic_int_get (&resource->ref_count) >= 2)
févr. 19 16:28:34 Error404 udisksd[2008]: Bail out! GLib-GIO:ERROR:../glib/gio/gresource.c:1451:g_static_resource_fini: assertion failed: (g_atomic_int_get (&resource->ref_count) >= 2)
févr. 19 16:28:35 Error404 audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=udisks2 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
févr. 19 16:28:35 Error404 dbus-daemon[763]: [system] Activation via systemd failed for unit 'dbus-org.bluez.service': Refusing activation, D-Bus is shutting down.
févr. 19 16:28:35 Error404 dbus-daemon[763]: [system] Activation via systemd failed for unit 'dbus-org.bluez.service': Refusing activation, D-Bus is shutting down.
févr. 19 16:28:35 Error404 dbus-daemon[763]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.Avahi.service': Refusing activation, D-Bus is shutting down.
févr. 19 16:28:35 Error404 dbus-daemon[763]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.Avahi.service': Refusing activation, D-Bus is shutting down.
févr. 19 16:28:45 Error404 dockerd[1074]: time="2023-02-19T16:28:45.453589904+01:00" level=info msg="Container failed to exit within 10s of signal 15 - using the force" container=3a74eed50e173a535e0f196475b0a658807118a58f86fd6e5f51c54a88622f8a
févr. 19 16:28:46 Error404 dbus-daemon[763]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.nm-dispatcher.service': Refusing activation, D-Bus is shutting down.
févr. 19 16:28:46 Error404 NetworkManager[777]: <warn>  [1676820526.9265] dispatcher: (17) failed (after 0.002 sec): Refusing activation, D-Bus is shutting down.
févr. 19 16:28:47 Error404 dbus-daemon[763]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.nm-dispatcher.service': Refusing activation, D-Bus is shutting down.
févr. 19 16:28:47 Error404 dbus-daemon[763]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.nm-dispatcher.service': Refusing activation, D-Bus is shutting down.
➜  ~

Il y a pas mal de trucs, je trouve... :/

J'ai fait ça, sinon.

➜  ~ sudo mkdir /etc/systemd/journald.conf.d
➜  ~ sudo touch /etc/systemd/journald.conf.d/size.conf
➜  ~ sudo nano /etc/systemd/journald.conf.d/size.conf
➜  ~  systemctl restart systemd-journald
➜  ~ cat /etc/systemd/journald.conf.d/size.conf
[Journal]
# taille du journald est de 300M sur un seul fichier
SystemMaxUse=300M
SystemMaxFileSize=100M
#on ne garde que 2 mois d'historique (si désire plus: 1year, ou moins: 15day)
#MaxRetentionSec=2month

#niveau maximum à enregistrer
# "emerg", "alert", "crit", "err", "warning", "notice", "info", "debug"
MaxLevelStore=warning

Audit=off
➜  ~

Bon, à priori c'est résolu, le géant est parti.
Là j'ai 32 Mo
Des erreur à la fermeture, semble t'il bénignes.

➜  ~ journalctl -b -3 | grep "fail"
févr. 25 20:18:49 Error404 bluetoothd[966]: src/service.c:btd_service_connect() a2dp-sink profile connect failed for 6F:0C:24:C6:5B:C3: Protocol not available
févr. 25 20:18:54 Error404 nextdns[805]: Endpoint provider failed: &{dns.nextdns.io https://dns.nextdns.io#45.90.28.0,2a07:a8c0::,45.90.30.0,2a07:a8c1::}: exchange: roundtrip: dial tcp 45.90.28.0:443: connect: network is unreachable
févr. 25 20:18:54 Error404 nextdns[805]: Endpoint failed: https://dns1.nextdns.io#45.90.28.0,2a07:a8c0::: roundtrip: dial tcp 45.90.28.0:443: connect: network is unreachable
févr. 25 20:18:54 Error404 nextdns[805]: Endpoint failed: https://dns2.nextdns.io#45.90.30.0,2a07:a8c1::: roundtrip: dial tcp [2a07:a8c1::]:443: connect: network is unreachable
févr. 25 20:20:09 Error404 systemd-xdg-autostart-generator[1656]: /home/sum/.config/autostart/safeeyes.desktop: stat() failed, ignoring: No such file or directory
févr. 25 21:22:58 Error404 NetworkManager[781]: <warn>  [1677356578.7687] dispatcher: (12) failed (after 0.000 sec): Refusing activation, D-Bus is shutting down.
➜  ~

bonjour

nam1962 a écrit : ↑il y a 1 an
journalctl -b -3

il me semble que tu as un problème avec la commande journalctl ? car j'ai du mal a interpréter tes options

-b c'est l'id (relatif) du boot, donc ici, tu ne recherches que dans le boot -3

-p est le 'level', avec 3 nous filtrons les erreurs (on peut même mettre 4)

| grep pour trouver une erreur : NON on utilise le "level". Et un "grep" n'est pas un filtre sûr (fail, error n'est pas dans tous les messages d'erreurs!). De plus existe l'option -g

journalctl -b0 -g 'disk' --no-pager

Comme je disais, parfois nous pouvons avoir du spam au niveau 'Notice/Info/debug' (genre chaque seconde). Donc notre journal peut se remplir très vite sans véritable erreur à rechercher par grep

journalctl -b0 -p 5..5 --no-pager   # QUE niveau 5
journalctl -b0 -p 5 --no-pager      # de niveau 5 à 0

0: emergency
1: alerte
2: critique
3: error
4: warning
5: notice
6: info
7: debug

Un moyen de voir si on a du spam (mes valeurs en commentaire):

journalctl -p 0..0 --no-pager -q --output-fields="_BOOT_ID" -o cat | wc -l    # 0
journalctl -p 1..1 --no-pager -q --output-fields="PRIORITY" -o cat | wc -l    # 4
journalctl -p 2..2 --no-pager -q --output-fields="PRIORITY" -o cat | wc -l    # 264
journalctl -p 3..3 --no-pager -q --output-fields="PRIORITY" -o cat | wc -l    # 1232
journalctl -p 4..4 --no-pager -q --output-fields="PRIORITY" -o cat | wc -l    # 22065
journalctl -p 5..5 --no-pager -q --output-fields="PRIORITY" -o cat | wc -l    # 6338
journalctl -p 6..6 --no-pager -q --output-fields="PRIORITY" -o cat | wc -l    # 222
journalctl -p 7..7 --no-pager -q --output-fields="PRIORITY" -o cat | wc -l    # 0

Pour avoir valeur exacte (pas forcément utile) :
-q : ne pas afficher entête
-o cat et --output : certains messages sont sur plusieurs lignes, on affiche qu'un seul champ

EDIT: un petit script qui retourne le nombre d'entrées

#!/usr/bin/bash
# ./journalctl-count.version1.sh 
boot="$1"
[[ ! -z $boot ]] && boot=" -b $boot"
echo "# niveau : Nombre d'entrées"
level=0
while [[ "$level" -le 7 ]]; do
    printf "$level : %8i \n" $(journalctl $boot -p $level..$level --no-pager -q --output-fields='_BOOT_ID' -o cat | wc -l)
    level=$(($level+1))
done

pour boot actuel:

./journalctl-count.sh 0
# niveau : Nombre d'entrées
0 :        0 
1 :        0 
2 :        2 
3 :        6 
4 :      299 
5 :       83 
6 :        4 
7 :        0

-----------
Puisque maintenant je connais le "level" avec plus d'erreurs, je peux affiner en recherchant les commandes pour voir si il y a un spammeur ...

journalctl -b0 -p 4..4 -o cat --output-fields _CMDLINE | awk '{++freq[$1]; sum[$1]+=$1}END{for (app in sum) print freq[app] " : " app}' | sort -nr

Il reste à intéger cette ligne dans le script ...

#!/usr/bin/bash
# ./journalctl-count.sh 
boot="$1"
[[ ! -z $boot ]] && boot=" -b $boot"

echo -e "# niveau : Nombre d'entrées\n"
declare -i toplevel=0 level=0 nbold=0
while ((level < 7)); do
    nb=$(journalctl $boot -p $level..$level --no-pager -q --output-fields='_BOOT_ID' -o cat | wc -l)
    printf "$level : %8i \n" $nb
    if ((nb > nbold)); then
        nbold=$nb
        toplevel=$level
    fi
    level=$(($level+1))
done

echo
echo "------------"
echo "Applications qui génèrent le plus d'entrées ($nbold) au niveau $toplevel :"
echo ""

journalctl $boot -p $toplevel..$toplevel -o cat --output-fields _CMDLINE | \
    awk '{++freq[$1]; sum[$1]+=$1}END{for (app in sum) if (freq[app] > 4) {print freq[app] " : " app}}' | \
    sort -nr

résultat:

Applications qui génèrent le plus d'entrées (333) au niveau 4 :

236 : /usr/bin/kwin_x11
21 : /usr/bin/plasmashell
8 : /usr/bin/sddm-greeter
6 : /usr/lib/systemd/systemd
5 : /usr/lib/org_kde_powerdevil
5 : /usr/lib/kf5/kioslave5

236 sur 333 ! Merci kwin

Waah ! Que puis-je dire, sinon "Super merci" !

Pour le souci :

➜  ~ journalctl -b0 -g 'disk' --no-pager
-- No entries --
➜  ~

➜  ~ journalctl -p 0..0 --no-pager -q --output-fields="_BOOT_ID" -o cat | wc -l    # 0
journalctl -p 1..1 --no-pager -q --output-fields="PRIORITY" -o cat | wc -l    # 4
journalctl -p 2..2 --no-pager -q --output-fields="PRIORITY" -o cat | wc -l    # 264
journalctl -p 3..3 --no-pager -q --output-fields="PRIORITY" -o cat | wc -l    # 1232
journalctl -p 4..4 --no-pager -q --output-fields="PRIORITY" -o cat | wc -l    # 22065
journalctl -p 5..5 --no-pager -q --output-fields="PRIORITY" -o cat | wc -l    # 6338
journalctl -p 6..6 --no-pager -q --output-fields="PRIORITY" -o cat | wc -l    # 222
journalctl -p 7..7 --no-pager -q --output-fields="PRIORITY" -o cat | wc -l    # 0
0
6
9
798
9121
4771
18278
3433
➜  ~