How to Fix /var/log Taking Too Much Space on Linux

What Causes This?

/var/log grows when Linux services keep writing new log entries and old logs are not rotated, compressed, or deleted properly. Common causes include verbose system logging, application errors that spam logs, failed logrotate jobs, or services like journald, web servers, and package managers keeping too much history. In some cases, a runaway process can generate massive log files in just a few hours.

Common Symptoms

• Disk space keeps shrinking even though you have not saved many new files
• You get “No space left on device” errors
• Updates, installs, or reboots start failing unexpectedly
• The system feels unstable because services cannot write temporary files
• /var/log contains one or more unusually large .log, .gz, or journal files

How to Fix It Manually

1. Check how large /var/log is

   • Open a terminal.
   • Run:

     sudo du -sh /var/log
     sudo du -h /var/log | sort -h | tail -20

   • This shows the total size and the biggest log files or folders.

2. Find the main offender

   • Look for large files in places like:
     • /var/log/journal
     • /var/log/syslog
     • /var/log/messages
     • /var/log/kern.log
     • /var/log/apache2/
     • /var/log/nginx/
   • To list the biggest files:

     sudo find /var/log -type f -printf '%s %p\n' | sort -n | tail -20

3. Clean old systemd journal logs

   • If journald is using too much space, check usage:

     journalctl --disk-usage

   • Remove old journal data by size:

     sudo journalctl --vacuum-size=200M

   • Or remove logs older than a few days:

     sudo journalctl --vacuum-time=7d

4. Force log rotation

   • Run:

     sudo logrotate -f /etc/logrotate.conf

   • This rotates active logs, compresses older ones if configured, and can immediately reduce space usage.

5. Delete or truncate oversized logs carefully

   • If a specific log file is huge, you can empty it without deleting the file:

     sudo truncate -s 0 /var/log/syslog

   • Replace /var/log/syslog with the actual file you found.
   • Avoid deleting active logs unless you know the service can recreate them safely.

6. Fix the underlying service creating too many logs

   • Check recent errors:

     sudo tail -100 /var/log/syslog
     sudo journalctl -xe

   • If a service is repeatedly failing, restart it after fixing the issue:

     sudo systemctl restart servicename

   • If needed, reduce overly verbose logging in that app’s config.

7. Verify log rotation is working

   • Check whether logrotate is installed and scheduled:

     which logrotate
     ls /etc/cron.daily/logrotate

   • Review config files:

     ls /etc/logrotate.d/

   • If logs keep growing, a broken rotation rule may need to be corrected.

Fix It Automatically with Kudu

Kudu can scan your Linux system, identify oversized logs in /var/log, and safely clean old log files, cached journals, and other junk that wastes disk space. It is the faster option if you do not want to inspect log folders manually or risk deleting the wrong file.

Download Kudu Free →