How to Clean Up Large Journal Logs on Linux

What Causes This?

Large journal logs on Linux are usually caused by systemd-journald keeping too much historical log data. This often happens when log size limits are not configured, the system has been running for a long time, or a service is repeatedly generating errors and filling the journal quickly. On systems with limited storage, these logs can grow large enough to noticeably reduce free disk space.

Common Symptoms

• Your Linux drive is running low on free space for no obvious reason
• The /var/log/journal folder is unusually large
• Commands like df -h show high disk usage
• The system feels slower during updates, installs, or boot
• You notice constant service errors being written to the journal

How to Fix It Manually

1. Check how much space the journal is using

   • Open a terminal.
   • Run:

     journalctl --disk-usage

   • This shows the total space currently used by journal logs.

2. Clean up old journal logs by size

   • To reduce the journal to a specific size, run:

     sudo journalctl --vacuum-size=500M

   • Replace 500M with a size that makes sense for your system, such as 200M or 1G.
   • This removes the oldest archived logs first and keeps newer entries.

3. Remove logs older than a certain age

   • If you want to keep only recent logs, run:

     sudo journalctl --vacuum-time=7d

   • This example deletes archived journal files older than 7 days.
   • You can change 7d to 3d, 2weeks, or another time period.

4. Verify that space was reclaimed

   • Run the disk usage check again:

     journalctl --disk-usage

   • You can also confirm overall free space with:

     df -h

5. Set a permanent journal size limit

   • Open the journald configuration file in a text editor:

     sudo nano /etc/systemd/journald.conf

   • Find or add lines like these:

     SystemMaxUse=500M
     SystemKeepFree=1G

   • SystemMaxUse limits total journal size.
   • SystemKeepFree tells journald to leave a minimum amount of disk space free.

6. Restart the journal service

   • Save the file, then restart journald:

     sudo systemctl restart systemd-journald

   • This applies the new limits.

7. Check for services creating excessive logs

   • View recent high-volume logs with:

     journalctl -p 3 -xb

   • If one service is constantly failing, fixing that service will stop the journal from growing so quickly.

Fix It Automatically with Kudu

If large logs are eating up storage, Kudu can detect oversized journal files and clean them up safely without you having to remember terminal commands. It can also help identify the apps and services creating excessive logs so the problem does not keep coming back.

Download Kudu Free →