Ubuntu 26.04 LTS – /var is full due to runaway logs – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Services fail and updates stop because /var has no free space left.

Environment & Reproduction

Frequent on busy nodes with verbose logging and stale journal retention.

df -h /var

Root Cause Analysis

Application logs, journal data, or crash dumps grew beyond retention limits.

Quick Triage

Locate top space consumers immediately.

sudo du -xh /var --max-depth=2 | sort -h | tail -n 20
sudo journalctl --disk-usage

Step-by-Step Diagnosis

Determine which service writes most frequently and why rotation failed.

sudo ls -lh /var/log
sudo logrotate -d /etc/logrotate.conf

Solution – Primary Fix

Vacuum old journal entries and rotate oversized logs safely.

sudo journalctl --vacuum-time=7d
sudo logrotate -f /etc/logrotate.conf

Solution – Alternative Approaches

Move high-volume application logs to dedicated storage with quotas.

Verification & Acceptance Criteria

Sufficient free space is restored and write-heavy services recover.

df -h /var
systemctl --failed

Rollback Plan

Recover removed logs from centralized logging archive if needed for compliance.

Prevention & Hardening

Set explicit retention limits and alert on /var utilization thresholds.

Related Errors & Cross-Refs

Often tied to apt failures, temporary file exhaustion, and service restarts loops.

Related tutorial: View the step-by-step tutorial for Ubuntu 26.04 LTS.

View all Ubuntu 26.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Ubuntu journald and logrotate operational guidance.