Notes

Occasional write-ups on systems, networks, and tooling.

Keeping journald from eating your disk

2026-10-14

On a small VPS, a chatty service can fill the disk in a matter of days. journald's defaults are generous, and the rate limiting is easy to misread.

Cap the total size

Edit /etc/systemd/journald.conf:

[Journal]
SystemMaxUse=500M
SystemMaxFileSize=50M
RuntimeMaxUse=100M
MaxRetentionSec=1month

Then restart:

systemctl restart systemd-journald

Without SystemMaxUse, journald grows until it hits its built-in cap of 10% of the filesystem, which on a 10 GB disk is more than it sounds.

Check what it is actually using

journalctl --disk-usage
du -sh /var/log/journal

If the reported size looks much smaller than du, you probably have rotated files waiting to be vacuumed.

Vacuum manually

journalctl --vacuum-time=14d
journalctl --vacuum-size=200M

A gotcha with rate limiting

The default RateLimitBurst=10000 over 30 seconds sounds high, but a service logging in a tight loop will exhaust it and then go silent for the rest of the window. Silent logs are worse than verbose ones when you are debugging, so raise the limit for the specific unit rather than globally:

[Service]
LogRateLimitIntervalSec=0
LogRateLimitBurst=0

Apply it in a drop-in under /etc/systemd/system/<unit>.service.d/.