SPAM in the console - systemd-journald[588]

[Savicava]

Hi, and thanks for the interest.

How should I go about disabling constant “systemd” SPAM in the console?

I enabled “Show Console Messages” many months ago in the GUI settings, and I like it.
Thing is, I don’t remember if I somehow triggered the SPAM behavior while I was fiddling with the Audit and Syslog, and I can’t seem to find any non-default settings relating to those in the GUI.
It could be that the “systemd” messages are the expected behavior, and are not any kind of error, but they fill my console, and I don’t know any benefit to that.
Changing the /etc/systemd/journald.conf line “ForwardToWall=yes” from “yes” to “no” could resolve this I think, but I’m not sure if it is advisable to change it, or what is the best way to change it.
Please advise if possible

Useful related topic links on other forums:

[systemd-devel] [RFC][PATCH 2/2] journald: add support for wall forwarding
How does one stop systemd-journald logging to console? / Newbie Corner / Arch Linux Forums
linux - How to resolve journalctl error - journal header limits reached or header out of date - Unix & Linux Stack Exchange

System information:

Complete HPE Microserver gen. 10 (not “plus”)
HPE = Hewlett Packard Enterprise

OS: TrueNAS 24.10 (Electric Eel)
Motherboard: HPE part number 871721-001.
CPU: “AMD” Opteron™ X3216
RAM: 16GB ECC DDR4 @2400 MHz (2x8 GB UDIMM HPE branded Hynix HMA81GU7AFR8N-UH).
PSU: “Delta” 200 Watts non-hot plug, non-redundant Power Supply
Storage: 2x3TB Seagate Ironwolf NAS HDD + 2x4TB Ironwolf NAS HDD
Boot drives: 2x NVMe Intel Optane 16GB SSD in mirror mode
Apps drives: 2x SATA HPE Adata 32GB SSD in mirror mode
UPS: APC BE650G2-GR, 650VA
Network: Embedded Broadcom BCM5720 Dual Port Gbe LOM

[Savicava]

Please, any guidance?

[neofusion]

If you have been manually editing files in the root filesystem my only recommendation is to download your configuration file (System → General Settings → Manage Configuration), including secure hashes, and then reinstall.

It’s possible updating to 25.04.1 will achieve the same “back to defaults” goal, but maybe you’re not ready to do that yet.

[RetroG]

if you’re seeing rotation that quickly you really should find out why.

[Savicava]

Thanks for the reply.
I regularly make config backups.
Haven’t changed any root filesystem files, but I will have the re-install option in mind.

[Savicava]

Thanks for the reply.
Everything points out to the user 3000 (my user) journal log.
Messages apper more often if I use the server more often.

[neofusion]

@Savicava

Haven’t changed any root filesystem files

Earlier you mentioned changing a file under /etc. If that was only theoretical and you haven’t actually made any edits to things under /etc or similar places, good.

TrueNAS isn’t a Linux distro where you’re meant to do that, it’s an Appliance OS and expects base OS files to not be altered by the user.

[Savicava]

It was just an idea. I really didn’t change the files.
I agree, the appliance OS like TrueNAS should almost always be altered only through the UI.

[Savicava]

Any other suggestions, please?
Before I resort to re-instalation?

[neofusion]

As @RetroG suggested, have you looked at the logs in question to see what is spamming them so much to trigger the frequent rotation?

I am not sure on the ideal flags, but I suspect sudo journalctl _UID=3000 --since today would show some relevant information.

[Savicava]

I did, and know It’s related to auditing, but not sure why would it keep showing that it’s rotating the journal all the time. Maybe it’s by design, because I didn’t set some low limit for the audit rotation back when it started happening.

Someone more familiar with logs or related knowledge could help.
Here is the result of your suggested command (extract from the similar long repeating pattern):

Summary

Sep 28 00:04:37 truenas TNAUDIT_SMB[2409640]: @cee:{“TNAUDIT”: {“success”: true, “aid”: “d8f3ee63-4ffb-428a-b415-c642929391b0”, “vers”: {“major”: 0, “minor”: 1}, “addr”: “fe80::48a8:4945:90f3:37ab”, “user”: “Savicava”, “sess”: “ff7bee79-9d44-4fc2-8bfe-5fc58a6f4d9d”, “time”: “2025-09-27 22:04:37.730565Z”, “svc”: “SMB”, “svc_data”: "{"vers": {"major": 0, "minor": 1}, "se>
Sep 28 00:04:37 truenas TNAUDIT_SMB[2409640]: @cee:{“TNAUDIT”: {“success”: true, “aid”: “89c81898-1744-42ea-9895-01579d006303”, “vers”: {“major”: 0, “minor”: 1}, “addr”: “fe80::48a8:4945:90f3:37ab”, “user”: “Savicava”, “sess”: “ff7bee79-9d44-4fc2-8bfe-5fc58a6f4d9d”, “time”: “2025-09-27 22:04:37.733258Z”, “svc”: “SMB”, “svc_data”: "{"vers": {"major": 0, "minor": 1}, "se>
Sep 28 00:04:37 truenas TNAUDIT_SMB[2471925]: @cee:{“TNAUDIT”: {“success”: true, “aid”: “0be0dcd1-837a-4f10-a186-c15686975c31”, “vers”: {“major”: 0, “minor”: 1}, “addr”: “192.168.1.4”, “user”: “Savicava”, “sess”: “8913fb69-7928-4409-92ff-fb5da4a43a8c”, “time”: “2025-09-27 22:04:37.795480Z”, “svc”: “SMB”, “svc_data”: "{"vers": {"major": 0, "minor": 1}, "service": "Mai>
Sep 28 00:04:37 truenas TNAUDIT_SMB[2471925]: @cee:{“TNAUDIT”: {“success”: true, “aid”: “791a9bd8-7e37-4a85-8aa2-d808c701656c”, “vers”: {“major”: 0, “minor”: 1}, “addr”: “192.168.1.4”, “user”: “Savicava”, “sess”: “8913fb69-7928-4409-92ff-fb5da4a43a8c”, “time”: “2025-09-27 22:04:37.798965Z”, “svc”: “SMB”, “svc_data”: "{"vers": {"major": 0, "minor": 1}, "service": "Mai>
Sep 28 00:04:38 truenas TNAUDIT_SMB[2409640]: @cee:{“TNAUDIT”: {“success”: true, “aid”: “c32843ab-02cc-499c-851d-d58f04e145b9”, “vers”: {“major”: 0, “minor”: 1}, “addr”: “fe80::48a8:4945:90f3:37ab”, “user”: “Savicava”, “sess”: “ff7bee79-9d44-4fc2-8bfe-5fc58a6f4d9d”, “time”: “2025-09-27 22:04:38.637174Z”, “svc”: “SMB”, “svc_data”: "{"vers": {"major": 0, "minor": 1}, "se>
Sep 28 00:04:38 truenas TNAUDIT_SMB[2409640]: @cee:{“TNAUDIT”: {“success”: true, “aid”: “79c39963-0c61-4360-9a95-1d3a7de6f3c4”, “vers”: {“major”: 0, “minor”: 1}, “addr”: “fe80::48a8:4945:90f3:37ab”, “user”: “Savicava”, “sess”: “ff7bee79-9d44-4fc2-8bfe-5fc58a6f4d9d”, “time”: “2025-09-27 22:04:38.639972Z”, “svc”: “SMB”, “svc_data”: "{"vers": {"major": 0, "minor": 1}, "se>
Sep 28 00:04:38 truenas TNAUDIT_SMB[2409640]: @cee:{“TNAUDIT”: {“success”: true, “aid”: “505f5460-3c72-4774-8fc3-17747f1eb5be”, “vers”: {“major”: 0, “minor”: 1}, “addr”: “fe80::48a8:4945:90f3:37ab”, “user”: “Savicava”, “sess”: “ff7bee79-9d44-4fc2-8bfe-5fc58a6f4d9d”, “time”: “2025-09-27 22:04:38.642791Z”, “svc”: “SMB”, “svc_data”: "{"vers": {"major": 0, "minor": 1}, "se>
Sep 28 00:04:38 truenas TNAUDIT_SMB[2409640]: @cee:{“TNAUDIT”: {“success”: false, “aid”: “c5d41344-a6c4-4b6a-9910-e97cd1a2b0a7”, “vers”: {“major”: 0, “minor”: 1}, “addr”: “fe80::48a8:4945:90f3:37ab”, “user”: “Savicava”, “sess”: “ff7bee79-9d44-4fc2-8bfe-5fc58a6f4d9d”, “time”: “2025-09-27 22:04:38.649899Z”, “svc”: “SMB”, “svc_data”: "{"vers": {"major": 0, "minor": 1}, "s>
Sep 28 00:04:38 truenas TNAUDIT_SMB[2409640]: @cee:{“TNAUDIT”: {“success”: true, “aid”: “7d9eaec9-d997-40b1-ae35-e791e326942c”, “vers”: {“major”: 0, “minor”: 1}, “addr”: “fe80::48a8:4945:90f3:37ab”, “user”: “Savicava”, “sess”: “ff7bee79-9d44-4fc2-8bfe-5fc58a6f4d9d”, “time”: “2025-09-27 22:04:38.652292Z”, “svc”: “SMB”, “svc_data”: "{"vers": {"major": 0, "minor": 1}, "se>