Cleanup journalctl Logs: Free Disk Space on SLES and RHEL

Quick one-liner: Running low on disk space? journalctl logs are the easiest thing to clean. Two commands, instant space recovery.

🤔 Why This Matters

If you're provisioning a small server — 20 GB root partition, a small VM, or a container host — you'll eventually notice disk space disappearing. One of the most common culprits is the systemd journal.

journald stores structured log data in binary files under /var/log/journal/ (persistent mode) or /run/log/journal/ (volatile mode). Over time, these files grow. On a busy system, they can consume gigabytes.

🔍 Step 1: Check How Much Space journalctl Is Using

Before you clean anything, see how much space you're dealing with:

$ journalctl --disk-usage
Archived and active journals take up 1.2G in the file system.

On a small server, 1.2 GB is a lot of wasted space — especially if you're on a 20 GB partition.

🧹 Step 2: Clean Up by Time

If you only want to keep the last few days of logs, use --vacuum-time:

$ sudo journalctl --vacuum-time=7d

This deletes all journal logs older than 7 days. You'll see output like:

Vacuuming done from all 3 journals.
Freed 890.3M of archived journals from /var/log/journal/abc123.

900 MB freed with one command.

📦 Step 3: Clean Up by Size

Alternatively, limit journal logs to a maximum size:

$ sudo journalctl --vacuum-size=100M

This keeps only the most recent 100 MB of logs and deletes everything older than that.

You'll see output like:

Vacuuming done from all 3 journals.
Freed 1.1G of archived journals from /var/log/journal/abc123.

⚙️ Step 4: Set a Permanent Limit (Optional)

If you don't want to run cleanup manually every month, set limits in the journald config.

Open /etc/systemd/journald.conf:

$ sudo vi /etc/systemd/journald.conf

Add or uncomment these lines:

[Journal]
SystemMaxUse=200M
MaxRetentionSec=14d

This caps journal logs at 200 MB total and auto-rotates after 14 days.

Apply the change:

$ sudo systemctl restart systemd-journald

🔒 When You Should Keep Logs Longer

There are times when you don't want to aggressively clean journal logs:

• Troubleshooting an intermittent issue — you might need logs from last week to trace a crash
• Audit and compliance — some environments require log retention for months or years
• Post-incident review — after an outage, journal logs are your first source of truth

In those cases, consider forwarding logs to a centralized logging system (rsyslog, ELK, Grafana Loki) instead of relying on the local journal.

✅ Quick Reference