Why journalctl Uses Disk Space and How to Set a Limit

On a system with persistent journaling, systemd journal files can occupy a noticeable share of /var. First measure their size and confirm whether the journal is persistent; do not delete logs before checking retention and incident-response needs.

journalctl --disk-usage
findmnt /var

The journal may be stored under /var/log/journal or only in runtime storage, depending on configuration. Other logs such as application files are not controlled by journald's limits.

Set a retention budget

Options such as SystemMaxUse= and SystemKeepFree= in journald configuration constrain persistent journal usage. Runtime settings have separate names. Read the installed version's documentation and any drop-ins before choosing values; the journal must leave enough room for other system data and useful diagnostic history.

The upstream journald.conf manual explains that limits apply to journal files and that only archived files are removed to reduce usage. Keep an operationally appropriate history, especially on systems where logs may be needed after an incident.

Understand manual vacuuming

journalctl --vacuum-size= and --vacuum-time= delete archived journal files to meet the requested limit. This is an irreversible log-retention action. Preserve required evidence and confirm the target before running a vacuum command on a production host. It does not remove an active journal file or unrelated application logs.

After configuring a limit, verify the effective configuration and monitor disk usage. If growth is driven by one noisy service, investigate its repeated messages too; a smaller journal can hide symptoms without fixing the source.