Why Are Logs Filling Up My Disk on Linux

What Causes This?

Linux systems write logs constantly to track errors, services, updates, and security events. If log rotation is misconfigured, disabled, or not keeping up, old logs can pile up and consume large amounts of disk space. This is especially common on servers, dual-boot systems, WSL setups, or Linux virtual machines running noisy apps that generate repeated errors.

Common Symptoms

• Disk space keeps shrinking even though you are not saving many files
• You see very large files in /var/log
• Apps, updates, or services start failing because the disk is full
• The system becomes slow or shows “No space left on device” errors
• Log files with names like .log, .gz, or numbered archives keep growing

How to Fix It Manually

1. Check whether logs are actually the problem.

   • On a Linux system, open Terminal.
   • Run:

     sudo du -sh /var/log
     sudo du -ah /var/log | sort -rh | head -20

   • This shows the total size of the log folder and the biggest files inside it.

2. Clear old rotated logs you no longer need.

   • Many systems keep compressed archives such as .gz files in /var/log.
   • To remove old compressed logs:

     sudo find /var/log -type f -name "*.gz" -delete

   • To remove old numbered logs:

     sudo find /var/log -type f -regex ".*\.[0-9]+$" -delete

   • Be careful not to delete active log files that services are currently writing to.

3. Vacuum systemd journal logs.

   • If your system uses journald, the journal can grow very large.
   • Check current journal usage:

     journalctl --disk-usage

   • Shrink it to a safer size:

     sudo journalctl --vacuum-size=200M

   • Or remove entries older than a set time:

     sudo journalctl --vacuum-time=7d

4. Truncate oversized active logs instead of deleting them.

   • If a service is actively using a huge log file, truncating it is safer than removing it.
   • Example:

     sudo truncate -s 0 /var/log/syslog
     sudo truncate -s 0 /var/log/kern.log

   • Replace the file path with the actual large log you found in step 1.

5. Force log rotation and verify the settings.

   • Run:

     sudo logrotate -f /etc/logrotate.conf

   • Then inspect common rotation rules:

     cat /etc/logrotate.conf
     ls /etc/logrotate.d

   • Look for logs that are missing rotation rules or being kept for too long.

6. Find and fix the app or service creating excessive logs.

   • Check the largest logs for repeated errors:

     sudo tail -100 /var/log/syslog
     sudo tail -100 /path/to/app.log

   • If one service is spamming errors, restart it and investigate the underlying issue:

     sudo systemctl restart service-name

   • If you only clear logs without fixing the source, the disk will fill up again.

Fix It Automatically with Kudu

Kudu can scan your system for oversized log files, old rotated logs, and other storage waste without making you hunt through folders manually. It helps you safely remove unnecessary files and reclaim disk space faster, especially if the problem keeps coming back.

Download Kudu Free →