Ubuntu 26.04 LTS – Journald disk usage grows uncontrollably – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Root filesystem fills quickly, causing service instability and failed writes.

Environment & Reproduction

Seen on noisy hosts with verbose logs and default retention settings.

df -h /
sudo journalctl --disk-usage
systemctl status systemd-journald

Root Cause Analysis

Journald retention limits are too high or unset for current workload log volume.

Quick Triage

Measure journal size and check whether logs are persistent.

sudo journalctl --disk-usage
ls -ld /var/log/journal
grep -E 'SystemMaxUse|RuntimeMaxUse' /etc/systemd/journald.conf

Step-by-Step Diagnosis

Inspect top log sources and burst patterns.

sudo journalctl -p err --since '24 hours ago' | tail -n 80
sudo journalctl -u  --since '24 hours ago' | wc -l
sudo systemctl show systemd-journald -p ActiveState

Solution – Primary Fix

Set journal size limits, vacuum old logs, and restart journald.

sudoedit /etc/systemd/journald.conf
sudo journalctl --vacuum-size=500M
sudo systemctl restart systemd-journald

Solution – Alternative Approaches

Forward logs to external aggregation and reduce local retention window.

sudo apt install -y rsyslog
sudo systemctl enable --now rsyslog

Verification & Acceptance Criteria

Disk usage stabilizes and journal stays within configured cap.

sudo journalctl --disk-usage
df -h /

Rollback Plan

Restore previous journald config if retention policy conflicts with audit requirements.

sudo cp /etc/systemd/journald.conf.bak /etc/systemd/journald.conf
sudo systemctl restart systemd-journald

Prevention & Hardening

Review noisy services regularly and enforce sane log verbosity settings.

sudo journalctl -u  --since '1 day ago' | tail -n 20
systemctl is-enabled systemd-journald

Related Errors & Cross-Refs

Related to full /var partitions, logrotate misconfiguration, and runaway debug logging.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Ubuntu systemd-journald retention and log management docs.