Ubuntu 26.04 LTS – system journal grows rapidly and fills disk – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Disk usage spikes under /var/log/journal, causing service disruption and failed writes.

Environment & Reproduction

Appears when noisy services emit repeated errors without retention caps.

df -h
journalctl --disk-usage
sudo du -sh /var/log/journal/* 2>/dev/null

Root Cause Analysis

Unbounded persistent journald storage and repetitive log storms fill available storage.

Quick Triage

Identify top-volume units and current journal retention behavior.

journalctl -p err -n 200 --no-pager
journalctl -u  -n 120 --no-pager
systemctl status systemd-journald

Step-by-Step Diagnosis

Trace recurring error sources and verify journald config defaults.

grep -RIn 'SystemMaxUse|RuntimeMaxUse' /etc/systemd/journald.conf /etc/systemd/journald.conf.d 2>/dev/null
sudo journalctl --since '1 hour ago' | tail -n 200

Solution – Primary Fix

Vacuum old journal data and set conservative retention limits.

sudo journalctl --vacuum-size=500M
sudo sed -i 's/^#*SystemMaxUse=.*/SystemMaxUse=500M/' /etc/systemd/journald.conf
sudo systemctl restart systemd-journald
journalctl --disk-usage

Solution – Alternative Approaches

Forward logs to remote collector and keep minimal local retention.

sudo sed -i 's/^#*ForwardToSyslog=.*/ForwardToSyslog=yes/' /etc/systemd/journald.conf
sudo systemctl restart systemd-journald

Verification & Acceptance Criteria

Journal size remains within configured thresholds and disk pressure subsides.

journalctl --disk-usage
df -h /var
sudo journalctl -p err -n 50 --no-pager

Rollback Plan

Restore previous journald config if retention policy is too aggressive for operations.

sudo cp /etc/systemd/journald.conf.bak /etc/systemd/journald.conf 2>/dev/null || true
sudo systemctl restart systemd-journald

Prevention & Hardening

Set per-service rate limits and alert on abnormal journal growth.

journalctl --disk-usage
systemctl show systemd-journald -p ExecMainStatus
df -h

Related Errors & Cross-Refs

Common with runaway crash loops, misconfigured debug logging, and failed retries.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Ubuntu journald configuration and log retention best-practice references.