CentOS Stream 10 – Common Problem 239 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Exported journald log files grow without bound because logrotate misses them and disk usage climbs.

Environment & Reproduction

Triggered when administrators export journal contents to /var/log/journal-export without rotation rules.

Root Cause Analysis

logrotate only manages paths explicitly listed in /etc/logrotate.d, while journald itself rotates binaries.

Quick Triage

Inspect /etc/logrotate.d and run logrotate -d /etc/logrotate.conf to confirm coverage.

Step-by-Step Diagnosis

Run: sudo logrotate -d /etc/logrotate.conf; du -sh /var/log/journal-export.

Solution – Primary Fix

Add /etc/logrotate.d/journal-export with daily rotate 14 compress missingok, then verify with logrotate -d.

Solution – Alternative Approaches

Use systemd timer to run journalctl –rotate plus journalctl –vacuum-size for native cleanup instead.

Verification & Acceptance Criteria

Disk usage stabilises and old export files are compressed and aged out per policy.

Rollback Plan

Remove the new logrotate file and restore filesystem from snapshot if behaviour regresses.

Prevention & Hardening

Define log retention policies as code and audit logrotate.d on every patching window.

Related Errors & Cross-Refs

Related to journald SystemMaxUse settings and audit.log rotation conflicts.

Related tutorial: View the step-by-step tutorial for centos-stream-10.

View all centos-stream-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

logrotate(8) and systemd-journald.conf(5).