Debian 13 – journald log growth consumes disk unexpectedly – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Disk usage grows rapidly under /var/log/journal, reducing service reliability.

Environment & Reproduction

Typical on noisy systems without retention limits.

journalctl --disk-usage
df -h /var
sudo du -sh /var/log/journal

Root Cause Analysis

Persistent journald storage with unlimited retention accumulates large volumes of logs.

Quick Triage

Measure current journal footprint and top message sources.

journalctl --disk-usage
journalctl -p err -n 100 --no-pager
systemctl status systemd-journald

Step-by-Step Diagnosis

Inspect journald config and identify high-volume units.

grep -E 'SystemMaxUse|RuntimeMaxUse|MaxRetentionSec' /etc/systemd/journald.conf
journalctl --since -1h | awk '{print $5}' | sort | uniq -c | sort -nr | head

Solution – Primary Fix

Set sane retention limits and vacuum old logs.

sudo sed -i 's/^#*SystemMaxUse=.*/SystemMaxUse=500M/' /etc/systemd/journald.conf
sudo sed -i 's/^#*MaxRetentionSec=.*/MaxRetentionSec=14day/' /etc/systemd/journald.conf
sudo systemctl restart systemd-journald
sudo journalctl --vacuum-time=14d

Solution – Alternative Approaches

Forward logs to external collector and reduce local retention.

sudo mkdir -p /etc/systemd/journald.conf.d
sudo tee /etc/systemd/journald.conf.d/forward.conf >/dev/null <<'EOF'
[Journal]
ForwardToSyslog=yes
EOF
sudo systemctl restart systemd-journald

Verification & Acceptance Criteria

Journal size remains within configured budget over time.

journalctl --disk-usage
cat /etc/systemd/journald.conf | grep -E 'SystemMaxUse|MaxRetentionSec'

Rollback Plan

Restore previous journald config if troubleshooting requires extended logs.

sudo cp -a /etc/systemd/journald.conf /var/tmp/journald.conf.bak.$(date +%s)
sudo systemctl restart systemd-journald

Prevention & Hardening

Alert on sudden log-rate spikes and disk growth trends.

journalctl -u systemd-journald --since -24h --no-pager
df -h /var

Related Errors & Cross-Refs

Often paired with application crash loops generating repetitive logs.

Related tutorial: View the step-by-step tutorial for Debian 13.

View all Debian 13 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian systemd-journald retention and operations guide.