Ubuntu 16.04 LTS – journald grows rapidly and fills /var – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Disk usage climbs rapidly and can block updates or service writes on /var.

Environment & Reproduction

Seen on chatty services without journald size and retention constraints.

Root Cause Analysis

Unbounded journal retention accumulates high-volume logs over time.

Quick Triage

Measure journal footprint and identify top contributing unit logs.

Step-by-Step Diagnosis

Review journald config, rotation behavior, and service logging verbosity.

Solution – Primary Fix

Apply journal size limits, vacuum old logs, and tune noisy service logging.

Solution – Alternative Approaches

Forward logs to centralized storage and reduce local retention horizon.

Verification & Acceptance Criteria

Journal growth stabilizes and /var free space remains above threshold.

Rollback Plan

Restore prior logging retention if forensic requirements demand deeper history.

Prevention & Hardening

Set default retention policy and monitor log growth continuously.

Related Errors & Cross-Refs

Often tied to root-full incidents and service restart storms.

Related tutorial: View the step-by-step tutorial for Ubuntu 16.04 LTS.

View all Ubuntu 16.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

systemd-journald retention and Ubuntu logging best-practice docs.