RHEL 9 Journalctl Shows Disk Usage Growing Rapidly

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Persistent journal logs consume excessive disk space on RHEL 9.

Environment & Reproduction

Root filesystem fills quickly and monitoring alerts show growth under /var/log/journal.

Root Cause Analysis

Verbose services, repeated failures, or missing retention limits in journald configuration.

Quick Triage

Run ‘sudo journalctl –disk-usage’ to confirm log storage impact and trend direction.

Step-by-Step Diagnosis

Use ‘sudo journalctl –vacuum-time=14d’ or size-based vacuum to reclaim immediate space.

Solution – Primary Fix

Configure SystemMaxUse and related options in journald.conf, then restart systemd-journald.

Solution – Alternative Approaches

Query frequent emitters with journalctl filters and tune service log levels where appropriate.

Verification & Acceptance Criteria

Use systemctl status for repeatedly failing units that can flood logs with crash loops.

Rollback Plan

Ensure journal directories keep expected labels so log rotation and access controls remain intact.

Prevention & Hardening

Consider remote forwarding for long retention while keeping local journals bounded for performance.

Related Errors & Cross-Refs

Re-check disk usage and filesystem pressure after policy updates using journalctl and df commands.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Establish environment-specific journal retention baselines and monitor drift continuously.