How to check systemd journal size in Linux

Checking the systemd journal size helps catch runaway logging before it fills a disk and starts triggering failures like aborted package installs, databases refusing writes, or services crashing during startup.

systemd-journald stores log entries in binary journal files and rotates them over time. journalctl can report the combined size of active and archived journals, making it easy to confirm whether log retention is staying within expected limits.

journalctl access often requires root privileges or membership in the systemd-journal group, and retention behavior is controlled by settings in /etc/systemd/journald.conf plus any drop-in overrides. Large journals can be normal on busy hosts, but a sudden size jump often points to a noisy unit or debug-level logging.

Related: How to investigate low disk space in Linux
Related: How to view system logs using journalctl

Steps to check systemd journal size with journalctl in Linux:

  1. Open a terminal with sudo privileges.
  2. Display total disk usage for the system journal. 
    $ sudo journalctl --disk-usage
Archived and active journals take up 10.0M in the file system.

    Reported size includes both active journals and rotated (archived) journal files.

  3. Display total disk usage for the current user's journals. 
    $ journalctl --user --disk-usage
Archived and active journals take up 10.0M in the file system.

    User journals are typically stored under ~/.local/share/systemd/journal when enabled.

  4. Check size of the persistent journal directory. 
    $ sudo du --summarize --human-readable /var/log/journal
8.0K	/var/log/journal

    Persistent storage survives reboots and is commonly used when /var/log/journal exists.

  5. Check size of the runtime journal directory. 
    $ sudo du --summarize --human-readable /run/log/journal
11M	/run/log/journal

    Runtime storage is usually on tmpfs and is cleared on reboot when journald runs in volatile mode.

  6. Review journald storage and retention limits in the configuration file. 
    $ sudo grep --extended-regexp '^[[:space:]]*(#)?(Storage|SystemMaxUse|SystemKeepFree|SystemMaxFileSize|RuntimeMaxUse|RuntimeKeepFree|RuntimeMaxFileSize|MaxRetentionSec|MaxFileSec)=' /etc/systemd/journald.conf
#Storage=auto
#SystemMaxUse=
#SystemKeepFree=
#SystemMaxFileSize=
#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=
#MaxRetentionSec=
#MaxFileSec=1month

    Uncommented values apply explicit limits; drop-ins in /etc/systemd/journald.conf.d override the main file.