Recommended Free Tools
Use a measurement-first cleanup: identify the full filesystem with df -hT, find the largest directories with du, inspect systemd journal usage with journalctl --disk-usage, then rotate and vacuum archived journal files with an explicit age, size, or file-count limit. Verify both journal usage and filesystem headroom afterward, and configure journald to preserve free space so the incident does not recur.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Do not start by deleting files from /var/log. Logs may be needed for incident response, security investigations, audits, or diagnosing the outage that filled the disk. A bounded cleanup preserves a defined amount of history while reclaiming space predictably.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What is filling the disk?
On a systemd-based Linux server, /var/log/journal contains persistent journal files when persistent logging is enabled. Journald also keeps active files that are currently being written and older archived files. The total reported by journalctl --disk-usage includes both categories. Vacuum operations remove archived files; they do not simply truncate every file that journald has open.
The /var/log tree can also contain ordinary text logs written by services, web servers, databases, authentication components, schedulers, and custom applications. Container runtimes may keep logs in their own directories. Each of those producers can have a different rotation and retention mechanism, so repeatedly vacuuming journald will not reclaim space if another directory is responsible.
#1 Best Overall
Runbook: measure first, then reclaim space
1. Confirm which filesystem is full
Run these commands before changing anything and save their output in the incident record:
df -hT
sudo du -xhd1 /var 2>/dev/null | sort -h
sudo du -xhd1 /var/log 2>/dev/null | sort -hdf -hT shows each mounted filesystem, its type, total capacity, used space, available space, and percentage used. This tells you whether the pressure is on the root filesystem, a separately mounted /var, or another mount entirely. The -x option in the du commands keeps a mounted filesystem from being counted as part of its parent mount; without it, a large mounted volume can make the directory report misleading.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe first du command identifies large top-level directories under /var. The second narrows the inspection to /var/log. Sorting numerically makes the largest entries easy to spot. If /var/log/journal is the dominant directory, use the journald procedure below. If a service-specific directory or a container-log directory is larger, investigate that owner instead.
2. Inspect journal usage and history
sudo journalctl --disk-usage
sudo journalctl --list-boots
sudo journalctl -p warning..alert -b--disk-usage reports the space used by active and archived journal files. --list-boots shows which boot records are available, helping you understand how much historical data would be affected by a retention change. The priority filter displays warning, error, critical, alert, and emergency messages from the current boot; it is a quick check for whether the host is already reporting a condition that should be preserved before cleanup.
Record the journal total before vacuuming. It provides a baseline for verification and prevents you from confusing a filesystem problem elsewhere with a journald problem.
Choose a bounded cleanup rule
Pick the rule that matches your operational and evidence requirements. The commands below act on archived journal files and should be preceded by rotation when immediate space recovery matters.
| Retention rule | Commands | What it guarantees | Best fit | Important limitation |
|---|---|---|---|---|
| Age | sudo journalctl --rotatesudo journalctl --vacuum-time=30d |
Removes the oldest archived data until entries older than the stated period are no longer retained by the vacuum operation. | Teams that explain retention in calendar terms to investigators, auditors, or incident responders. | Storage consumption can still vary widely with log volume during the retained period. |
| Size | sudo journalctl --rotatesudo journalctl --vacuum-size=500M |
Removes the oldest archived files until archived journal data is below the specified size. | Hosts that need a predictable storage ceiling. | The resulting history length depends on how quickly the server generates logs. |
| File count | sudo journalctl --rotatesudo journalctl --vacuum-files=5 |
Retains only the selected number of archived journal files. | Environments that manage retention in discrete files or need a simple cap. | A file-count limit does not guarantee a byte limit; individual files can be very different sizes. |
The systemd manual defines --vacuum-size= as removing the oldest archived journal files until the space they use falls below the specified size. The same principle applies to the time and file-count bounds: vacuum works from the oldest archived files and stops when the selected condition is met.
Rotate before vacuuming
Run --rotate immediately before the vacuum command:
sudo journalctl --rotate
sudo journalctl --vacuum-time=30dRotation archives files that are currently active. Vacuum then has more eligible archived data to remove, giving the operation its greatest effect. You can substitute the size or file-count command from the table, but keep the same order.
Use one policy deliberately rather than stacking unrelated limits during an emergency. An age rule is easier to justify when a documented investigation window is required. A size rule is more useful when the filesystem has a strict capacity budget. A file-count rule is convenient but should not be treated as a substitute for a byte ceiling.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How the limits interact with active files
It is important to distinguish a cleanup target from a promise about the number shown by --disk-usage. The vacuum controls evaluate archived journal files. The usage report, however, adds active files to that total. If journald is in the middle of writing a large active file, the reported total can remain above a size target even after every eligible archive has been removed.
That behavior is not evidence that the command failed. Rotate first to make the current file eligible, run the bounded vacuum, and then compare both measurements again. A remaining active file is still serving the logging process and should not be deleted manually. If the filesystem remains critically full, look at the du results and open deleted files rather than escalating to an unbounded removal.
What not to do during an incident
- Do not run an unbounded command that deletes every file under
/var/logor/var/log/journal. You may destroy evidence and still leave the service that is producing the logs misconfigured. - Do not remove an active journal file with
rmwhile journald is writing to it. The process can continue holding the deleted inode open, so the apparent free space may not return until the owning service closes the file. - Do not choose a retention period shorter than your organization’s incident-response, legal, regulatory, or contractual requirement simply because the disk is full. Preserve or export the required evidence first, then apply the smallest safe reduction.
- Do not assume that a small journal means the whole logging problem is solved. Text logs and container logs are separate consumers with implementation-specific policies.
Verify the result correctly
sudo journalctl --disk-usage
df -hT
sudo lsof +L1Compare the new values with the baseline. It is normal for the number reported by --disk-usage to remain higher than the vacuum target immediately afterward: the usage total includes active files, while vacuum acts on archived files. Rotation improves the amount that can be reclaimed, but it does not make active files disappear while they are in use.
lsof +L1 lists open files whose directory entries have been deleted. If a large deleted log appears there, identify the owning service and restart or otherwise reload it according to your change-control procedure. Restarting a production service can interrupt traffic, so schedule it or fail over first when the service architecture allows. Re-run df -hT after the process closes the descriptor.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →If journald is not the largest consumer
Ordinary text logs
Use the du output to identify the service directory, then inspect its rotation files, timestamps, and configuration. Look for a current file that is growing rapidly, a set of compressed rotations that never expire, or an application that writes a separate debug log outside the normal rotation path. Correct the service’s own policy rather than repeatedly vacuuming the journal. If a file is needed for diagnosis, copy it to an approved evidence location before reducing retention.
Application and database logs
Application logging often has its own verbosity and retention settings. A sudden increase in debug or trace output can fill a filesystem even when journald’s policy is sound. Confirm which process owns the file, determine whether a configuration reload is sufficient, and record the change so normal verbosity can be restored after the incident.
Container-runtime logs
Container logs may live outside /var/log/journal and may be managed by the container runtime or by the orchestration layer. Find their directory with the filesystem measurements, then use that runtime’s documented rotation and retention controls. Avoid truncating a live container log blindly; the runtime may maintain offsets or hold the file open, producing confusing accounting and incomplete records.
Prevent journald from consuming the filesystem again
Review the effective journald configuration before changing it:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorssudo grep -RInE '^(SystemKeepFree|RuntimeKeepFree|SystemMaxUse|RuntimeMaxUse|MaxRetentionSec|MaxFileSec)=' /etc/systemd/journald.conf /etc/systemd/journald.conf.d 2>/dev/null
sudo systemctl cat systemd-journaldSystemKeepFree and RuntimeKeepFree are documented controls that tell journald how much space to leave available for other uses. The former applies to persistent system storage; the latter applies to runtime storage. Set values that leave meaningful headroom on the actual filesystem, not merely a percentage copied from another host. A small server and a log-heavy production host may need very different absolute free-space reserves.
The same review exposes related limits such as SystemMaxUse, RuntimeMaxUse, MaxRetentionSec, and MaxFileSec. Check the systemd version and distribution documentation on the host before relying on a directive’s exact behavior, especially when configuration fragments in /etc/systemd/journald.conf.d override the main file.
Apply a policy change through your normal change process. Depending on the distribution and the change, a controlled systemctl restart systemd-journald may be required; use the method supported by your operating procedure and verify that logging resumes. Recheck journal usage and filesystem headroom after the next rotation cycle rather than assuming the edit took effect.
Designing a retention policy that survives an incident
Separate evidence requirements from capacity limits
Write down the minimum history needed for troubleshooting and security review before choosing a number. If investigators require 30 days, a 30-day age rule expresses that requirement directly. If the host can spare only 500 MiB, a size rule protects capacity but may retain far less than 30 days during a noisy event. When those goals conflict, increase storage, reduce log volume at the source, or move required records to approved central storage; do not silently discard evidence.
Account for burst volume
Normal daily usage is not a safe capacity estimate when a service can enter a retry loop or emit stack traces rapidly. Leave free space for an abnormal burst and for package operations, temporary files, and recovery tools. The keep-free settings are intended to reserve space for these other uses, so evaluate them against the size of the whole filesystem rather than the current journal total.
Test the policy
After a change, check the effective configuration, perform a controlled rotation, and observe the next cleanup. Confirm that old records disappear according to the selected rule, that current messages remain queryable, and that df -hT still shows the required headroom. Keep the before-and-after measurements with the change record.
Best Value
- New
- Mint Condition
- Dispatch same day for order received before 12 noon
- Guaranteed packaging
- No quibbles returns
Troubleshooting common outcomes
| Symptom | Likely explanation | Next action |
|---|---|---|
/var/log/journal is large, but vacuum frees little space. |
Most of the reported usage is in active files, which vacuum does not remove. | Run sudo journalctl --rotate, repeat the chosen bounded vacuum, then verify both journal usage and filesystem space. |
| The journal is small, but the filesystem is still nearly full. | Text logs, application data, package caches, temporary files, or container logs are the dominant consumer. | Use the du results to identify the responsible directory and apply that component’s supported retention procedure. |
df still shows little free space after deleting a log. |
A process still has the deleted file open. | Run sudo lsof +L1, identify the owner, and restart or reload it under change control. |
| Old boot records are needed for an investigation. | The requested cleanup would remove evidence inside the selected retention window. | Preserve or export the records first, then choose a less aggressive bound or expand storage. |
| Usage grows back quickly after cleanup. | A noisy service, missing rotation policy, or overly permissive retention setting is still producing data. | Compare measurements over time, inspect the largest directory again, and correct the producer or journald policy rather than repeating emergency deletion. |
A repeatable operational checklist
- Capture
df -hT,du -xhd1 /var, anddu -xhd1 /var/logoutput. - Run
sudo journalctl --disk-usageand note the active and archived total. - Check available boots and high-priority current-boot messages with
--list-bootsand-p warning..alert -b. - Confirm the retention and evidence requirement before deleting anything.
- Rotate with
sudo journalctl --rotate. - Vacuum with exactly one explicit bound:
--vacuum-time=,--vacuum-size=, or--vacuum-files=. - Verify with
journalctl --disk-usageanddf -hT. - Use
sudo lsof +L1if filesystem space has not returned as expected. - If journald was not the main consumer, follow the owning application’s or container runtime’s rotation procedure.
- Review
SystemKeepFreeandRuntimeKeepFree, apply an approved policy change, and observe the next rotation cycle.
There is no universal disk-savings figure for this procedure: the reclaimed space depends on the host’s log rate, existing retention settings, active-file sizes, and which component actually filled the filesystem. Measuring those variables first is what makes the cleanup safe and repeatable.
Frequently Asked Questions
How do I safely clean up systemd journal logs?
Measure first with journalctl --disk-usage, rotate active files with sudo journalctl --rotate, then use one bounded command such as sudo journalctl --vacuum-time=30d, --vacuum-size=500M, or --vacuum-files=5. Verify with journalctl --disk-usage and df -hT.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Why does journalctl still report more space than my vacuum-size target?
The usage total includes active and archived files, while vacuum removes archived files. Rotation makes the active file eligible for cleanup, but a file still being written remains in the total.
Should I delete everything in /var/log when the disk is full?
No. Unbounded deletion can destroy incident or compliance evidence, remove files that services still need, and fail to address the process producing excessive logs. Identify the largest directory and apply its supported retention procedure.
What is the difference between vacuum-time, vacuum-size, and vacuum-files?
--vacuum-time removes older archived data by age, --vacuum-size removes oldest archived files until their combined space is below a limit, and --vacuum-files keeps only a selected number of archived files. File count does not guarantee a byte limit.
How can I stop systemd logs from filling the disk again?
Review journald’s effective configuration and set appropriate SystemKeepFree and RuntimeKeepFree reserves. Also review related maximum-use and retention directives, apply changes through change control, and verify behavior after the next rotation cycle.
What if /var/log/journal is not the largest directory?
Inspect the directory identified by du. Ordinary service logs, application or database logs, and container-runtime logs use separate policies. Correct the responsible producer’s rotation or verbosity settings instead of repeatedly vacuuming journald.
The Bottom Line
Freeing Linux server space safely means measuring first, preserving required evidence, rotating active journals, and applying one explicit vacuum bound. Verify both journal usage and filesystem headroom, check for open deleted files, then configure journald’s keep-free policy and the responsible service’s rotation so the problem does not return.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
