Ubuntu 26.04 LTS – journal logs consume root filesystem unexpectedly – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Root partition fills rapidly, causing service failures and package operation issues.

Environment & Reproduction

Common when verbose services generate sustained logs without journald caps.

df -h
journalctl --disk-usage

Root Cause Analysis

Persistent journal retention defaults allow unbounded growth under high log volume.

Quick Triage

Measure journal size and identify top disk consumers under /var.

journalctl --disk-usage
sudo du -xh /var | sort -h | tail -n 20

Step-by-Step Diagnosis

Find noisy units and estimate growth rate before applying retention policies.

journalctl --since '2 hours ago' --no-pager | wc -l
systemctl --failed
journalctl -p warning..alert -n 200 --no-pager

Solution – Primary Fix

Vacuum old logs and define journald size/time limits.

sudo journalctl --vacuum-time=7d
sudo mkdir -p /etc/systemd/journald.conf.d
sudo tee /etc/systemd/journald.conf.d/10-retention.conf >/dev/null <<'EOF'
[Journal]
SystemMaxUse=500M
RuntimeMaxUse=200M
MaxRetentionSec=14day
EOF
sudo systemctl restart systemd-journald

Solution – Alternative Approaches

Forward logs to centralized collectors and reduce local persistence.

grep -E 'ForwardToSyslog|Storage' /etc/systemd/journald.conf

Verification & Acceptance Criteria

Journal size remains within policy and disk usage stabilizes.

journalctl --disk-usage
df -h

Rollback Plan

Remove retention drop-in and restart journald to return defaults.

sudo rm -f /etc/systemd/journald.conf.d/10-retention.conf
sudo systemctl restart systemd-journald

Prevention & Hardening

Add alerts for /var usage and anomalous log throughput spikes.

Related Errors & Cross-Refs

Linked with rsyslog loops and runaway debug logging levels.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

systemd-journald retention and Ubuntu logging best practices.