Oracle Linux 10 – journald consumes excessive disk space under /var/log/journal – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Root filesystem fills due to unbounded journal retention, risking service disruption.

Environment & Reproduction

Frequent high-volume logs with default retention limits.

journalctl --disk-usage
df -h /var

Root Cause Analysis

journald size caps are unset or too large for current disk allocation.

Quick Triage

Measure journal footprint and top noisy units.

journalctl --disk-usage
journalctl -u myservice --since '1 day ago' | wc -l

Step-by-Step Diagnosis

Review journald config and identify bursty services.

grep -E 'SystemMaxUse|RuntimeMaxUse' /etc/systemd/journald.conf
journalctl -p warning --since '24 hours ago'

Solution – Primary Fix

Set retention caps and vacuum old entries.

sudo sed -i 's/^#SystemMaxUse=.*/SystemMaxUse=1G/' /etc/systemd/journald.conf
sudo systemctl restart systemd-journald
sudo journalctl --vacuum-size=1G

Solution – Alternative Approaches

Forward logs to remote collector and reduce local persistence period.

Verification & Acceptance Criteria

Journal storage remains within defined budget.

journalctl --disk-usage
df -h /var

Rollback Plan

Restore previous journald.conf and restart daemon if retention was too aggressive.

Prevention & Hardening

Set platform-wide log budgets and detect runaway logging early.

Related Errors & Cross-Refs

Can coincide with logrotate backlog and filesystem inode exhaustion.

Related tutorial: View the step-by-step tutorial for oracle-linux-10.

View all oracle-linux-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

systemd-journald configuration and retention guidance for RHEL.