Linux systemd Journal Using Too Much Disk Space Fix

What Does This Error Mean?

The systemd journal is the log system on most modern Linux distributions. By default, it can grow to fill 10% of your disk or up to 4 GB — whichever is smaller. On small drives or servers with lots of log activity, the journal can become very large and contribute to the disk filling up. You can limit its size and clean it up with a single command.

Affected Models

Ubuntu
Debian
Fedora
CentOS
Arch Linux
Linux Mint
openSUSE

Common Causes

The journal has no configured size limit and has grown over months or years
A failing service is logging errors at a very high rate, rapidly filling the journal
A bug in an application is generating thousands of log entries per second
The system has been running a long time without any log rotation or cleanup
The default journal size limit is too large for the drive capacity

How to Fix It

Check journal disk usage. Run: journalctl --disk-usage to see how much disk space the journal is currently using.

Typical output looks like: Archived and active journals take up 2.3G in the filesystem. This tells you the total size.
Vacuum old journal entries by size. Run: sudo journalctl --vacuum-size=500M to keep only the newest 500 MB of logs. Adjust the size as needed.

This is the quickest way to free up journal space. It deletes the oldest archived journal files until the total is under the specified size.
Vacuum by time. Run: sudo journalctl --vacuum-time=7d to delete all logs older than 7 days. Use 2weeks, 1month, or 1year as the time unit.

Time-based vacuum is useful for keeping a rolling window of logs without worrying about total size.
Set a permanent size limit. Edit /etc/systemd/journald.conf and add or uncomment: SystemMaxUse=500M. Then restart journald: sudo systemctl restart systemd-journald

This prevents the journal from ever growing past 500 MB going forward. For servers with active logs, 1G to 2G is a reasonable limit.
Find the service generating excessive logs. Run: sudo journalctl --since today | grep -oP 'UNIT=[^ ]+' | sort | uniq -c | sort -rn | head -10 to see which services are generating the most entries today.

A service in a crash loop or generating thousands of errors per minute is a sign of a real problem. Fix the service, not just the logs.

When to Call a Professional

Journal size issues are entirely manageable without professional help. The commands below let you check, clean, and limit the journal. If a service is generating excessive logs, finding and fixing the root cause is more important than just cleaning up the logs.

Frequently Asked Questions

Will deleting old journal entries affect my system?

No — journal entries are just log records. Deleting them does not affect running services, installed packages, or your files. The only consequence is that you cannot look back at older log history if you need to investigate a past issue.

What is the difference between syslog and journald?

Traditional Linux systems used syslog and rsyslog to write logs as plain text files in /var/log/. journald is systemd's integrated log system — it stores logs in a binary format with metadata. journald can also forward logs to rsyslog, so both systems can run side by side. mostmodern systems use journald as the primary log system.

How do I read logs from the last boot only?

Run: journalctl -b to see all logs from the current boot. Run: journalctl -b -1 to see logs from the previous boot. Run: journalctl -b -2 for the boot before that, and so on. This is very useful for finding what went wrong during a crash or failed boot.