journalctl shows persistent disk pressure from logs

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Systemd journal growth consumes root filesystem capacity.

Environment & Reproduction

Low disk alerts fire and /var/log/journal occupies several gigabytes.

Root Cause Analysis

Run journalctl –disk-usage and inspect /etc/systemd/journald.conf retention settings.

Quick Triage

No size cap configured or noisy services generate excessive structured logs.

Step-by-Step Diagnosis

Set SystemMaxUse and RuntimeMaxUse, then vacuum old journals to reclaim space safely.

Solution – Primary Fix

Check journalctl –disk-usage again and confirm filesystem free space returns to target threshold.

Solution – Alternative Approaches

Tune logging levels and cap verbose application output in production.

Verification & Acceptance Criteria

Restore previous journald settings and restart systemd-journald if retention becomes too aggressive.

Rollback Plan

Deploy journald policy templates with role-specific retention limits.

Prevention & Hardening

journalctl –disk-usage; journalctl –vacuum-size=500M; systemctl restart systemd-journald

Related Errors & Cross-Refs

Provide top noisy units and sample logs before requesting platform-level retention exceptions.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Forwarding logs to centralized collectors reduces reliance on large local journal retention.