How to check systemd journal size in Linux

Checking the systemd journal size shows whether log retention is quietly consuming disk space under /var or tmpfs-backed runtime storage. That quick size check is useful before troubleshooting low space, deciding whether log cleanup is warranted, or confirming that a recent burst of errors did not leave an oversized journal behind.

The systemd-journald service stores binary journal files in a persistent location under /var/log/journal or a volatile location under /run/log/journal, depending on how the host is configured. The journalctl command with

--disk-usage

reports the combined size of active and archived journal files, and a direct du check shows which storage area is actually carrying the space.

Reading the full system journal typically requires sudo or membership in the systemd-journal group. If /var/log/journal is missing or very small, the host may be keeping logs only in runtime storage and the total can reset at reboot, while explicit limits in /etc/systemd/journald.conf or drop-ins can explain why the journal stays larger or smaller than expected.

1. Display the total space used by active and archived journal files.

   $ sudo journalctl --disk-usage
   Archived and active journals take up 16.0M in the file system.

   The reported total includes the current journal files and rotated archives, so it is the quickest high-level size check.

   Related: How to free disk space on Linux

2. Compare the persistent and runtime journal directories to see where that space is stored.

   $ sudo du -sh /var/log/journal /run/log/journal
   17M	/var/log/journal
   0	/run/log/journal

   /var/log/journal keeps logs across reboots, while /run/log/journal holds volatile logs that disappear at reboot.

3. Review the size-related journald settings before deciding whether the current total is expected.

   $ sudo grep --extended-regexp '^[[:space:]]*(#)?(Storage|SystemMaxUse|SystemKeepFree|SystemMaxFileSize|RuntimeMaxUse|RuntimeKeepFree|RuntimeMaxFileSize|MaxRetentionSec|MaxFileSec)=' /etc/systemd/journald.conf
   #Storage=auto
   #SystemMaxUse=
   #SystemKeepFree=
   #SystemMaxFileSize=
   #RuntimeMaxUse=
   #RuntimeKeepFree=
   #RuntimeMaxFileSize=
   #MaxRetentionSec=
   #MaxFileSec=1month

   Uncommented values set explicit limits, and drop-ins under /etc/systemd/journald.conf.d can override the main file, so use systemd-analyze cat-config systemd/journald.conf when the reported size does not match the base file alone.