How do I check journal disk usage before changing log retention?
Journal retention balances available storage with the evidence required for support and investigation. Measure actual usage before reducing it. Manual deletion or aggressive vacuuming can permanently remove the incident history you are trying to diagnose, and active journal files do not behave exactly like ordinary application logs.
Before you start
- An authorised SSH session on the Linux server.
Instructions
1. Measure journal and filesystem usage
Inspect both the journal’s reported footprint and the filesystem that stores it. The journal may be persistent on disk or volatile under /run.
sudo journalctl --disk-usage
df -h /var/log /runThe journal total includes available active and archived files. Filesystem space can also be consumed by unrelated applications.
2. Review the effective retention configuration
Read the systemd-journald configuration through the supported configuration viewer, including drop-ins. Keep any proposed limits aligned with incident and operational needs.
systemd-analyze cat-config systemd/journald.confInspect Storage, SystemMaxUse, RuntimeMaxUse and retention-related settings. Defaults and availability depend on the installed systemd version.
Check the result
- The storage location, current usage and intended retention window are understood before approving any cleanup or policy edit.
Troubleshooting
- The filesystem is full but journal usage is small
- Investigate other directories, inode consumption and deleted-but-open files.
- Old records are missing already
- Check volatile logging, rotation and existing retention limits. Increasing retention now cannot recreate records that are gone.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.