RHEL 9 journalctl shows rapid disk growth in logs

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

System log partition fills quickly due to unbounded or high-volume journald data.

Environment & Reproduction

Low disk alerts, large /var/log/journal size, and slower maintenance operations.

Root Cause Analysis

Verbose services, missing journald limits, or repeated crash loops generating noisy logs.

Quick Triage

Run journalctl –disk-usage and review noisy units with journalctl -u unit-name.

Step-by-Step Diagnosis

Use journalctl –vacuum-size or –vacuum-time to reclaim space without deleting all history.

Solution – Primary Fix

Configure SystemMaxUse and RuntimeMaxUse in journald.conf, then restart systemd-journald.

Solution – Alternative Approaches

Resolve repetitive errors in failing units rather than only trimming logs.

Verification & Acceptance Criteria

Tune RateLimitIntervalSec and RateLimitBurst where excessive bursts are expected.

Rollback Plan

Confirm journal directories maintain correct contexts after migration or manual edits.

Prevention & Hardening

Track journal growth with regular metrics and alert before partition exhaustion.

Related Errors & Cross-Refs

Define log retention standards in baseline hardening for all RHEL 9 hosts.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Recheck disk usage and verify stable growth after 24 hours of normal workload.