Debian 9 – /var/log partition fills and blocks services – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Services fail to write state and logs when /var/log is full, causing cascading failures.

Environment & Reproduction

Common on verbose workloads or misconfigured log rotation and retention settings.

Root Cause Analysis

Unbounded logs, crash loops, or disabled compression exceed available partition capacity.

Quick Triage

Identify largest directories quickly and confirm whether growth is active or historical.

Step-by-Step Diagnosis

Measure top consumers and map growth source to specific service behavior or logging policy.

Solution – Primary Fix

Rotate and purge safely, then correct retention and verbosity to stabilize ongoing growth.

Solution – Alternative Approaches

Move high-volume logs to separate storage with quotas and centralized shipping.

Verification & Acceptance Criteria

Free space returns above threshold and services recover normal write behavior.

Rollback Plan

Restore archived logs if removed data is needed for compliance or investigation.

Prevention & Hardening

Set log volume alerts and enforce rotation standards per service criticality.

Related Errors & Cross-Refs

Frequently accompanies inode exhaustion and journal retention misconfiguration.

Related tutorial: View the step-by-step tutorial for Debian 9.

View all Debian 9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian logrotate and journald storage configuration documentation for sustained operations.