How to check systemd journal size

Checking the systemd journal size helps catch runaway logging before it fills a filesystem and starts breaking package installs, service restarts, or application writes.

The systemd-journald service writes binary journal files and rotates them over time. journalctl –disk-usage reports the combined space used by active and archived journal files, which makes it the fastest way to confirm whether the journal itself is the source of disk growth.

Storage mode and retention limits come from the main /etc/systemd/journald.conf file plus any drop-ins shown by systemd-analyze cat-config systemd/journald.conf. Current systemd builds default to Storage=auto, which uses persistent storage only when /var/log/journal exists, and per-user journals are unavailable unless persistent storage is enabled.

1. Display the total space used by the journal.

   $ sudo journalctl --disk-usage
   Archived and active journals take up 8.0M in the file system.

   This total includes both active journal files and rotated archived files.

   If you later vacuum archived logs, journalctl –disk-usage can remain above the target until the active journal rotates because vacuum commands remove archived files only.

2. Inspect the merged journald storage and retention settings.

   $ sudo systemd-analyze cat-config systemd/journald.conf | grep --extended-regexp '^# /(etc|run|usr/lib)/systemd/|^[[:space:]]*(#)?(Storage|SystemMaxUse|SystemKeepFree|SystemMaxFileSize|RuntimeMaxUse|RuntimeKeepFree|RuntimeMaxFileSize|MaxRetentionSec|MaxFileSec)='
   # /etc/systemd/journald.conf
   #Storage=auto
   #SystemMaxUse=
   #SystemKeepFree=
   #SystemMaxFileSize=
   #RuntimeMaxUse=
   #RuntimeKeepFree=
   #RuntimeMaxFileSize=
   #MaxRetentionSec=
   #MaxFileSec=1month
   # /usr/lib/systemd/journald.conf.d/syslog.conf

   systemd-analyze cat-config shows the main file and drop-ins in load order. The last uncommented value for a setting is the one journald uses, while commented lines in the main file show the shipped defaults.

3. Check the persistent journal directory when the host keeps logs across reboots.

   $ sudo sh -c '[ -d /var/log/journal ] && du --summarize --human-readable /var/log/journal || echo "/var/log/journal does not exist"'
   4.0K	/var/log/journal

   This path matters when Storage=persistent is set or when Storage=auto finds /var/log/journal already present.

4. Check the runtime journal directory when the host is using memory-backed storage.

   $ sudo sh -c '[ -d /run/log/journal ] && du --summarize --human-readable /run/log/journal || echo "/run/log/journal does not exist"'
   8.1M	/run/log/journal

   This path is usually on tmpfs and is cleared on reboot. It is the active store when Storage=volatile is set or when Storage=auto falls back to memory.

5. Compare the reported size against the active limits before deciding whether cleanup is needed.

   By default, SystemMaxUse and RuntimeMaxUse allow up to 10% of the filesystem, SystemKeepFree and RuntimeKeepFree reserve 15% for other uses, each default is capped at 4G, MaxFileSec defaults to 1month, and MaxRetentionSec is disabled unless explicitly set.

   Related: How to clear old journal logs