Debian 12 Root Partition Full from Unbounded Journal Logs

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

System services fail when root filesystem reaches capacity and cannot write state files.

Environment & Reproduction

Persistent journald configured without strict retention limits.

df -h

Root Cause Analysis

Journal logs grow unchecked during noisy error periods and consume root volume.

Quick Triage

Identify largest directories and verify journal contribution.

sudo du -xh /var/log --max-depth=1 | sort -h

Step-by-Step Diagnosis

Check journal disk usage and retention settings.

journalctl --disk-usage

Solution – Primary Fix

Vacuum old journals and enforce bounded retention settings.

sudo journalctl --vacuum-size=500M

Solution – Alternative Approaches

Ship logs to centralized storage and minimize local persistence footprint.

Verification & Acceptance Criteria

Root free space recovers and remains stable under normal service activity.

df -h /

Rollback Plan

Restore archived logs if compliance or forensic needs require older entries.

Prevention & Hardening

Set journald size limits and alert on filesystem utilization thresholds.

Related Errors & Cross-Refs

Link to apt failures and database crashes caused by full disk conditions.

Related tutorial: View the step-by-step tutorial for debian-12.

View all debian-12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Review systemd-journald.conf and Debian logging architecture guidance.