journalctl Logs Grow Too Large on RHEL 9

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Systemd journal storage grows rapidly and threatens /var capacity.

Environment & Reproduction

journalctl –disk-usage reports unexpectedly high usage and log writes dominate disk I/O.

Root Cause Analysis

No retention caps configured, verbose failing services, or high-frequency debug logging.

Quick Triage

Measure journal size and identify noisy units via journalctl –since and unit filters.

Step-by-Step Diagnosis

Apply immediate cleanup with journalctl –vacuum-size or –vacuum-time.

Solution – Primary Fix

Set SystemMaxUse and related limits in journald.conf, then restart systemd-journald.

Solution – Alternative Approaches

Fix root cause of repetitive errors rather than only truncating logs repeatedly.

Verification & Acceptance Criteria

If journal files were moved or restored, ensure correct labels under /var/log/journal.

Rollback Plan

Confirm disk usage stabilizes and critical logs remain available for retention period.

Prevention & Hardening

Relax overly strict limits if compliance or forensic retention needs are not met.

Related Errors & Cross-Refs

Define journald quotas in baseline build and monitor growth rate continuously.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

journalctl –disk-usage; journalctl –vacuum-time=7d; systemctl restart systemd-journald