Search guides

Fix a log that fills disk

We'll find large logs with du -sh /var/log, shrink the journal with journalctl --vacuum-size, configure logrotate, and free space—or tell you when to escalate.

Troubleshooting · Servers & Linux
10–20 min
What you'll need
  • SSH or console access with sudo
Step 1 of 7

Quick triage — pick your path

Get started

Choose the option that matches what you see. You can jump straight to that section.

Show full guide

Steps

Goal: Find large logs, shrink the journal, rotate or truncate, and free disk space.

  • Run df -h to confirm which filesystem is full. Run du -sh /var/log to see log usage.
  • Good: /var/log is large. Proceed to Find large logs.
  • Bad: Other dirs are larger—see fix-linux-runs-out-of-disk.

Find large logs

Goal: Identify which logs use the most space.

  • Run du -sh /var/log for total. Drill down with du -sh /var/log/*. Often journal, syslog, or application logs.
  • Good: Large logs identified. Proceed to Shrink journal and rotate.
  • Bad: Run du on specific subdirs to isolate.

Shrink journal and rotate

Goal: Free space from the systemd journal and rotated logs.

  • Run journalctl --vacuum-size=100M to shrink the journalctl journal. For time-based: journalctl --vacuum-time=7d.
  • Run logrotate -f /etc/logrotate.conf to force a logrotate cycle.
  • For large files with no rotation: sudo truncate -s 0 /var/log/<file>. Use truncate, not delete, for open files.
  • Good: Space freed. Check df -h to confirm.
  • Bad: Add logrotate config for noisy services. See When to escalate.

Add logrotate config

Goal: Prevent logs from filling the disk again.

  • Check /etc/logrotate.d/ for the service. Add size 50M and rotate 4 to limit growth.
  • When a service has no config, create one. Restart the service if you truncated an open log.
  • Good: Config limits log growth. Monitor with df -h.
  • Bad: Service logs from a third-party—escalate if you cannot change config.

When to escalate

Escalate if:

  • You cannot safely free space.
  • Logs are from a critical third-party service you do not control.
  • You need to add storage or change retention policy.

Provide du -sh /var/log output and relevant logrotate configs.

Verification

  • df -h shows increased free space on the affected filesystem.
  • journalctl --disk-usage shows reduced journal size.
  • Applications and services run without “disk full” errors.
  • Logrotate configs limit size and retention for noisy services.

Escalation ladder

Work from the device outward. Stop when the problem is fixed.

  1. Find large logs Run du -sh /var/log to identify what uses space.
  2. Shrink journal journalctl --vacuum-size=100M or --vacuum-time=7d.
  3. Rotate and truncate logrotate -f; truncate large files.
  4. Add logrotate config Configure size and retention for noisy services.
  5. Escalate Provide du output and logrotate configs; consider add storage.

What to capture if you need help

Before calling support or posting for help, have these ready. It speeds everything up.

  • df -h output
  • du -sh /var/log output
  • Relevant logrotate configs
  • Steps already tried

Is /var/log using most of the disk?

Run du -sh /var/log and df -h to compare.

Run `du -sh /var/log` and `df -h`. Good: /var/log is large and matches the full filesystem. Bad: Other dirs are larger—see fix-linux-runs-out-of-disk.

Yes No

You can change your answer later.

Other dirs larger

See fix-linux-runs-out-of-disk for general disk-full. Run `du -sh /* 2>/dev/null` to find large dirs.

Done

Is the journal large?

Check /var/log/journal or run journalctl --disk-usage.

Run `journalctl --disk-usage`. Large: run `journalctl --vacuum-size=100M`. Small: proceed to rotated logs.

Yes No

You can change your answer later.

Shrink journal

Run `journalctl --vacuum-size=100M`. Check `df -h` to confirm space freed. If still full, proceed to logrotate.

Done

Rotate and truncate logs

Run `logrotate -f /etc/logrotate.conf`. For large files with no rotation: `sudo truncate -s 0 /var/log/<file>`. Check `df -h` again.

Yes No

You can change your answer later.

Done

Disk has free space. Add logrotate config for noisy services to prevent recurrence.

Done

Escalate

Gather du -sh /var/log and logrotate configs. Escalate if you cannot safely free space or need to add storage.

Done

Reviewed by Blackbox Atlas

Frequently asked questions

Why do logs fill the disk?
Application logs, systemd journal, or services that log heavily can grow without bound. Logrotate may not be configured or may run too infrequently.
Can I safely delete log files?
Truncate with truncate -s 0 or rotate with logrotate. Avoid deleting files that are open—truncate is safer. Archive old logs if you need them.
When should I escalate a log-filled disk?
If you cannot identify the source, logs are from a critical service you do not control, or you need to add storage or change retention policy.

Rate this guide

Was this helpful?

Continue to