How to Configure systemd-journald Log Rotation on a Server

Configuring systemd-journald Log Rotation

systemd-journald log rotation is configured through journald.conf parameters. The main limits are defined by disk usage, maximum journal size, and retention time. After changing the configuration, restart the service and verify the actual journal state using journalctl.

Checking the Current Configuration and Storage Mode

First, determine where journald stores its data. If persistent storage is enabled, journals are located in the /var/log/journal directory. If the persistent directory is missing, systemd-journald may store data only in memory.

journalctl --disk-usage

The command shows the current disk space used by journals. It is also useful to check the service status:

systemctl status systemd-journald

journald configuration is read from multiple locations. The main custom configuration is usually created as a separate drop-in file in the /etc/systemd directory to avoid modifying the system package file.

ls -la /etc/systemd/journald.conf /etc/systemd/journald.conf.d/

To view the effective configuration, you can use:

systemd-analyze cat-config systemd/journald.conf

Support for this command depends on the systemd version installed in a particular distribution. If the command is unavailable, check the parameters directly in the configuration files being used.

Do not manually delete journal files from the journald storage directory while the service is running. Use standard journalctl commands or configuration parameters to free disk space.

Creating a Configuration to Limit Log Size

Create a directory for additional configuration:

mkdir -p /etc/systemd/journald.conf.d

Create a file, for example:

nano /etc/systemd/journald.conf.d/10-storage.conf

Example settings:

[Journal]
Storage=persistent
SystemMaxUse=1G
SystemKeepFree=500M
MaxRetentionSec=1month

The Storage=persistent parameter enables storing system journals on disk. SystemMaxUse limits the maximum size of journal files, while SystemKeepFree reserves free space on the filesystem. MaxRetentionSec defines the maximum retention period for journals.

Values should be selected according to the server purpose. For example, a small virtual server may be fine with a limit of several hundred megabytes, while systems with auditing and a high event volume require more storage.

Applying Changes

After changing the configuration, restart journald:

systemctl restart systemd-journald

Verify that the service is running:

systemctl is-active systemd-journald

After that, check disk usage again:

journalctl --disk-usage

If you need to immediately reduce the journal size to a specified value, use the built-in cleanup command:

journalctl --vacuum-size=500M

Time-based cleanup is also available:

journalctl --vacuum-time=1month

These commands remove old archived journals to free space. They do not replace permanent limit configuration in journald.conf.

Enabling Persistent Journal Storage

If the server must preserve logs after reboot, check whether the persistent journal directory exists:

ls -ld /var/log/journal

If the directory does not exist, it can be created:

mkdir -p /var/log/journal
systemctl restart systemd-journald

After that, verify data placement:

journalctl --list-boots

The boot list allows you to confirm that logs from previous system starts are available.

Automatic Control Through systemd

systemd-journald automatically manages archiving and deletion of journals when configured limits are reached. A separate cron job or systemd timer for normal journald rotation is not required.

During server operation, it is important to monitor not only journal size but also available filesystem space:

df -h /var/log

If logs continue growing quickly, a size limit does not remove the underlying cause. You should identify the source of the large number of messages:

journalctl -p warning..alert
journalctl --since "1 hour ago"

The first command displays messages with levels from warning to alert, while the second limits output to the last hour. The specific set of levels and filters depends on the troubleshooting task.

Common Limitations and Specific Cases

Situation	What to check
Disk fills up quickly	Journal size using `journalctl --disk-usage` and the source of a large number of messages
Logs disappear after reboot	Persistent storage availability and the `/var/log/journal` directory
Configuration changes were not applied	Correctness of the file in `/etc/systemd/journald.conf.d/` and service restart
Logs need to be stored longer	The values of `SystemMaxUse` and `MaxRetentionSec`

Verifying the Result After Configuration

Check the current journal size using journalctl --disk-usage.
Make sure the configuration file is located in the /etc/systemd/journald.conf.d/ directory.
Restart systemd-journald.
Check the service status using systemctl is-active systemd-journald.
Verify that limits are applied and available disk space is monitored.