journalctl Disk Usage Grows Too Large

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Disk space under /var decreases rapidly and journalctl reports large persistent logs.

Environment & Reproduction

Run journalctl –disk-usage and check /etc/systemd/journald.conf retention settings.

Root Cause Analysis

No size/time limits are configured and verbose services flood systemd-journald.

Quick Triage

Set SystemMaxUse and RuntimeMaxUse, restart journald, and optionally vacuum with journalctl –vacuum-size.

Step-by-Step Diagnosis

Capture initial journal size and top noisy units before retention tuning.

Solution – Primary Fix

journalctl –disk-usage reports controlled size and growth aligns with policy.

Solution – Alternative Approaches

Monitor /var usage and confirm logs are retained for required compliance windows.

Verification & Acceptance Criteria

Set retention defaults in base images and reduce debug log levels in production.

Rollback Plan

Restore previous journald.conf if truncation policy is too aggressive for audit requirements.

Prevention & Hardening

Template journald.conf via automation and enforce service-specific logging levels.

Related Errors & Cross-Refs

Use journalctl -u systemd-journald and unit logs to identify excessive emitters.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Share retention settings, growth trend, and noisy unit evidence when escalating.