Stack Exchange
What causes journal logs to end with tilde (~)?
Many of my journal log files consistently are named ending with tilde, e.g. -
/var/log/journal/dc104498c02e4392903c4b68c856a662 $ ls -ltrh
total 768M
-rw-r-----+ 1 root systemd-journal 8.0M Jun 11 11:59 system@0005e130a3f4ba41-1a5b3de36e6e1a83.journal~
-rw-r-----+ 1 root systemd-journal 8.0M Jun 11 12:08 system@0005e130c31fa149-a264e2fef5695fe3.journal~
-rw-r-----+ 1 root systemd-journal 8.0M Jun 11 12:10 system@0005e130cbc7ce3e-afe601ad1d2f7384.journal~
-rw-r-----+ 1 root systemd-journal 8.0M Jun 11 12:16 system@0005e130e260ab6c-8cbee483baad4441.journal~
-rw-r-----+ 1 root systemd-journal  16M Jun 12 11:19 system@0005e14434aa7963-71677f727f29b453.journal~
...

They also happen to be always multiples of 8M in size.
What might cause this?
I suspect the files may be incomplete, but they seem to always end properly -
journalctl --file system@0005e130e260ab6c-8cbee483baad4441.journal~ | tail
Jun 11 12:16:30 z390 audit: BPF prog-id=0 op=UNLOAD
Jun 11 12:16:30 z390 kernel: audit: type=1334 audit(1654974990.059:192): prog-id=0 op=UNLOAD
Jun 11 12:16:30 z390 audit: BPF prog-id=0 op=UNLOAD
Jun 11 12:16:30 z390 systemd[1]: Using hardware watchdog 'iTCO_wdt', version 0, device /dev/watchdog0
Jun 11 12:16:30 z390 systemd[1]: Watchdog running with a timeout of 10min.
Jun 11 12:16:30 z390 kernel: watchdog: watchdog0: watchdog did not stop!
Jun 11 12:16:30 z390 systemd-shutdown[1]: Using hardware watchdog 'iTCO_wdt', version 0, device /dev/watchdog0
Jun 11 12:16:30 z390 systemd-shutdown[1]: Watchdog running with a timeout of 10min.
Jun 11 12:16:30 z390 systemd-shutdown[1]: Syncing filesystems and block devices.
Jun 11 12:16:30 z390 systemd-journald[569]: Journal stopped


Are these logs rotated by logrotate or some other log rotation software?

As a general line, tilde terminated filenames denote temporary files. Perhaps they're not being cleaned up for some reason? I'm not aware of the specifics of journald file management though.

Yes, logrotate.timer is in systemd which runs daily. But the clean split (the lines in ~ files always start with a boot, and ends at poweroff or reboot) makes me suspect it is something else that runs on reboot which causes them to be left like that.

Only files starting with system@... have this problem. There is no journal files starting with user-1000@... that end with ~.

Traditionally in Unix-like systems files ending with a tilde are backup files. For example, most text editors use this convention.

I have some user files with the ~ on them.
-rw-r-----+ 1 root systemd-journal  25165824 Jan 29 13:01 user-1000@0005f36ae72da0ba-7cb185f012612eb1.journal~
-rw-r-----+ 1 root systemd-journal   8388608 Jan 29 13:07 user-1000@0005f36afe061260-52662477b2f75a6c.journal~
-rw-r-----+ 1 root systemd-journal   8388608 Jan 29 13:20 user-1000@0005f36b2b96fdac-88e1fa9d097c4130.journal~
-rw-r-----+ 1 root systemd-journal  67108864 Feb 19 20:27 user-1000@0005f5179ddf6fec-24a4126c2ac07df9.journal~
I am thinking when the computer freezes up and do a hard power reboot by holding the power button in for more than 5 seconds might cause these.
