Excessive journal logs consume storage

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Disk usage grows rapidly under /var/log/journal, risking service interruption from full partitions.

Environment & Reproduction

RHEL 7 host with verbose services and default or oversized journald retention settings.

Root Cause Analysis

Noisy unit logs and missing caps for SystemMaxUse/RuntimeMaxUse in journald config.

Quick Triage

Run journalctl –disk-usage and identify high-volume units with journalctl -u counts.

Step-by-Step Diagnosis

Review /etc/systemd/journald.conf, inspect repeated error loops, and verify logrotate interplay.

Solution – Primary Fix

Set journald size/time limits, restart systemd-journald, and vacuum old logs safely.

Solution – Alternative Approaches

Forward journals to remote collector and keep minimal local retention for incident response.

Verification & Acceptance Criteria

Journal disk usage stabilizes under target and critical logs remain searchable.

Rollback Plan

Restore previous journald settings and restart daemon if troubleshooting depth becomes insufficient.

Prevention & Hardening

Cap verbose debug logging in services and include journal growth alerts in monitoring.

Related Errors & Cross-Refs

No space left on device under /var/log/journal, repeated crash-loop logs.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

journald.conf man page, journalctl options guide, RHEL 7 logging documentation.