RHEL 7 – journald Disk Usage Grows Until /var Is Full

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Services fail due to lack of disk space, causing application errors and unstable operations.

Environment & Reproduction

Observed on verbose systems without configured journald retention limits.

Root Cause Analysis

Persistent journal files grow unchecked in /var/log/journal under heavy logging load.

Quick Triage

Run journalctl –disk-usage and check systemctl status systemd-journald for warnings.

Step-by-Step Diagnosis

Review journald.conf size settings and identify noisy units via journalctl filters.

Solution – Primary Fix

Set SystemMaxUse and retention values, vacuum old logs, and restart journald service.

Solution – Alternative Approaches

Forward logs to centralized rsyslog destination and reduce local persistence footprint.

Verification & Acceptance Criteria

Disk usage stabilizes and /var free space remains above operational thresholds.

Rollback Plan

Restore previous journald configuration if retention settings remove needed audit data.

Prevention & Hardening

Monitor journal growth trends and alert before /var utilization reaches critical levels.

Related Errors & Cross-Refs

No space left on device, journald write failed, service start failures from full disk.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL 7 systemd-journald retention and log management best practices.