The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Start by identifying which filesystem and log owner are consuming space, then reclaim journal space with an explicit retention limit. The safest emergency sequence is df -hT, du to locate the largest directory, journalctl --disk-usage to measure the systemd journal, followed by journalctl --rotate and one bounded vacuum command. Verify with df -hT, and configure journald’s free-space policy so the problem does not return.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Why Linux log files fill a server
Linux writes several kinds of logs. systemd-journald stores binary journal files, commonly under /var/log/journal for persistent logs or in volatile runtime storage. Traditional daemons and applications may write ordinary text files under /var/log. A container runtime can keep a separate set of JSON or other log files. Clearing the journal will not recover space held by an application log or a container log.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
A full filesystem is also different from a full directory. A mount such as /var may be its own filesystem, while /var/log is merely a directory inside it. Always identify the affected mount before deleting anything. Keep logs required for incident response, security investigations, or compliance; an emergency cleanup should use the shortest retention rule your obligations allow, not an unbounded deletion command.
Log growth is often a symptom rather than the root cause. A service in a restart loop, a failed network dependency, or an application emitting an error for every request can refill a filesystem immediately after cleanup. Before removing historical data, inspect recent warning and error entries and note which process is still writing. Space recovery and diagnosis are separate tasks: reclaim enough capacity to stabilize the host, then correct the source of the excess logging.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
1. Measure the filesystem before changing logs
Record the current state first. These commands show filesystem type and capacity, then rank the first directory level beneath /var and /var/log:
df -hT
sudo du -xhd1 /var 2>/dev/null | sort -h
sudo du -xhd1 /var/log 2>/dev/null | sort -hdf -hTreports used and available space for each mounted filesystem and includes the filesystem type.du -xhd1stays on the same filesystem. The-xmatters when a child directory is another mount; without it, usage from that mount can be wrongly attributed to the parent.2>/dev/nullsuppresses transient permission errors while the inventory runs. If a directory is inaccessible, inspect it separately with appropriate privileges.sort -horders human-readable sizes, making the largest directory easy to spot.
Save this output in your incident record. If another mount, such as a database or container volume, is the one at capacity, cleaning /var/log will not solve the outage. Compare the mount named in df with the path reported by du; a large directory on a different filesystem may have no effect on the full mount.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRun the inventory with enough privilege to see all relevant files, but do not recursively change ownership or permissions just to make the command succeed. Permission errors can hide the real consumer. In that case, repeat the specific directory with sudo and preserve the original output so you can compare measurements after cleanup.
2. Determine whether journald is the large consumer
When /var/log/journal is the dominant directory, inspect the journal itself:
sudo journalctl --disk-usage
sudo journalctl --list-boots
sudo journalctl -p warning..alert -b--disk-usage reports the space used by both active and archived journal files. That total is the baseline for deciding how much to retain. --list-boots shows which boots have journal data, and the priority query displays warning-through-alert messages from the current boot so you can see whether a service is producing a continuing error storm before you delete historical evidence.
Active files are the files journald is currently writing. Archived files are closed files eligible for vacuum operations. This distinction explains many apparently confusing results: a large total does not mean every byte can be removed immediately, and a successful vacuum does not promise that the displayed total will equal the selected limit.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If the journal is not a significant part of the directory total, do not keep vacuuming it. Follow the non-journal branch later in this guide and identify the application, daemon, or container runtime that owns the large files. Repeating a journal command against a small journal only consumes time while the actual full mount continues to fill.
Use the priority query as a quick health check, not as a substitute for service-specific investigation. A flood of warning-or-higher messages indicates that deleting old files may provide only temporary relief. Capture the relevant boot and service context before reducing retention if an incident investigation is underway.
3. Choose a retention rule before vacuuming
Journal vacuum options remove the oldest archived files until a bound is satisfied. Select a rule that matches how your team investigates incidents and what records it must preserve.
| Rule | Command option | What it controls | Best fit | Important limitation |
|---|---|---|---|---|
| Age | --vacuum-time=30d (example) |
Removes archived files older than the specified period. | An organisation that explains retention in days to investigators. | Storage use can still vary greatly with log volume. |
| Size | --vacuum-size=500M (example) |
Removes oldest archived files until their combined space is below the requested size. | A host that needs a predictable ceiling for archived data. | The reported total can remain above the target because active files are included in --disk-usage. |
| File count | --vacuum-files=5 (example) |
Retains only the requested number of archived journal files. | A simple cap when file count is more useful than bytes or age. | It does not guarantee a byte ceiling; file sizes differ. |
These example values are not universal defaults. Confirm the retention period or evidence requirement for this server before running them. A size cap can remove old data quickly on a busy host, while an age rule can consume more space than expected during a logging surge. A file-count rule is the least predictable in bytes.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Think through the trade-off before selecting a command. Age-based retention is straightforward to explain to investigators: entries older than the stated period are eligible. Size-based retention makes capacity planning easier, but a sudden logging burst can shorten the historical window dramatically. File-count retention is simple to communicate, yet a few unusually large files can consume far more space than expected.
Retention is not the same as backup. If security or audit records must be preserved, copy or forward them to the approved evidence store before vacuuming. Do not assume that keeping five files, 500 MiB, or 30 days on one host satisfies an organization-wide retention requirement.
4. Rotate and vacuum the journal safely
Rotate first, then apply exactly one explicit bound. Rotation archives the currently active files so the vacuum operation can act on them. The systemd documentation notes that combining rotation with vacuum has the greatest effect.
Keep archived data for 30 days
sudo journalctl --rotate
sudo journalctl --vacuum-time=30dThis is appropriate when an age-based retention requirement is clear. Files newer than the selected period remain available. The command removes eligible archived files; it does not promise that every journal byte older than 30 days is represented by a single file boundary.
Cap archived journal data at 500 MiB
sudo journalctl --rotate
sudo journalctl --vacuum-size=500MThe size option removes the oldest archived journal files until the space they use falls below the specified size. It does not truncate a file in place to make an exact byte total. The systemd journalctl manual describes this behavior as removing the oldest archived files until the disk space they use falls below the specified size.
Retain five archived files
sudo journalctl --rotate
sudo journalctl --vacuum-files=5This limits the number of archived files, but the resulting storage amount depends on how much data each file contains. It can be useful when an operational process is expressed in file generations, but it is not a substitute for a byte limit on a small filesystem.
Use one vacuum criterion per emergency action so the intended result is clear and auditable. If you later need a different policy, document the reason and run a new measured operation rather than stacking unexplained commands. Keep the command output, timestamp, selected bound, and approving operator with the incident record.
Do not combine an emergency command with a blanket rm against /var/log. Removing files behind a running service can bypass its rotation policy, destroy evidence, or leave a process writing to a deleted inode. The bounded journal controls preserve a stated rule and make the change auditable.
Rotation itself is not deletion. It closes the active journal and starts another file, allowing archived-file cleanup to reach data that was previously active. If a service continues to generate messages during the operation, new active data can appear immediately; that is expected and is another reason to verify both journal usage and filesystem usage afterward.
5. Verify reclaimed space and handle open deleted files
Run the measurements again after vacuuming:
sudo journalctl --disk-usage
df -hT
sudo lsof +L1Do not assume that --disk-usage must equal the number supplied to --vacuum-size. The usage report includes active journal files, while vacuum operates on archived files. Rotation improves the result, but a service that is still producing logs can keep active files large.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Compare the new df output with the saved baseline, not only with the journal figure. df measures blocks available on the filesystem; journalctl --disk-usage measures journal files. Other files may have changed between the two measurements, and filesystem accounting can therefore show a different improvement than the journal-specific number.
lsof +L1 lists open files whose directory entries have been deleted. If a large log appears there, the owning process still holds its disk blocks. Restarting that service normally releases the space, but do so only under your change-control and availability procedures. Record the process, file, and restart decision; deleting the directory entry alone does not free the blocks until the process closes the file.
Before restarting, identify whether the process is a critical service, whether a graceful reload is available, and whether a maintenance window is required. The appropriate action depends on the service and your availability procedure. After any approved restart, run df -hT and lsof +L1 again to confirm that the blocks were released.
6. Stop journald from consuming the filesystem again
Inspect the effective journald service and any local configuration snippets:
sudo grep -RInE '^(SystemKeepFree|RuntimeKeepFree|SystemMaxUse|RuntimeMaxUse|MaxRetentionSec|MaxFileSec)=' /etc/systemd/journald.conf /etc/systemd/journald.conf.d 2>/dev/null
sudo systemctl cat systemd-journaldSystemKeepFree and RuntimeKeepFree tell journald how much space to leave available for other uses. Review those values against the size of the filesystem and the amount of space other services need. The same inspection includes maximum-use and rotation-related settings, so you can see whether a drop-in or distribution default is governing the host.
SystemKeepFree concerns persistent journal storage, while RuntimeKeepFree concerns runtime storage. Check which kind of storage is filling before changing either value. A setting that protects one filesystem will not automatically constrain logs written to a different mount or by a separate application.
Free tools Windows power users keep installed
One-click scans. No signup required.
Change the policy through your normal configuration-management or change-control process. Do not copy a value from another server without accounting for filesystem size, logging volume, and retention obligations. If your distribution requires a reload or controlled restart for the change to take effect, schedule that operation according to your service-availability procedure; the commonly used controlled action is:
sudo systemctl restart systemd-journaldAfter the next rotation cycle, check both journalctl --disk-usage and df -hT. Keep the emergency vacuum rule and the long-term policy aligned: a 30-day operational requirement should not be followed by a configuration that silently retains only a few files.
Free-space settings are guardrails, not a promise of a fixed historical window. The amount of history retained depends on message volume and the other limits configured on the host. Monitor the next rotation cycle and record whether the journal remains within the intended bound while leaving room for packages, temporary files, databases, and other services.
7. When the journal is not the problem
If /var/log/journal is small, use the directory inventory to locate ordinary text logs and inspect their owners. Common branches include:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Service and daemon logs
Identify which package or service writes the large file, then review that service’s own rotation and retention configuration. Truncating or removing a file without understanding its writer can lose evidence or leave the process holding an open deleted file. Apply the service’s documented rotation mechanism, then verify with df -hT and lsof +L1.
Do not assume that every file under /var/log belongs to journald. A daemon may maintain its own naming scheme, rotation schedule, compression, and retention controls. Follow the owning service’s supported procedure and preserve the configuration change so the same emergency does not require ad hoc deletion next time.
Application logs
Applications may use their own directories, formats, and retention rules. Determine whether the growth is a legitimate workload or a repeated error by inspecting recent entries. Fixing the error source is more durable than repeatedly deleting its output. Preserve the period needed for troubleshooting before reducing retention.
When an application log is rapidly growing, capture a representative sample and the process identity before cleanup. That evidence can reveal whether a deployment, dependency failure, or misconfigured verbosity level is responsible. Once capacity is restored, coordinate the application owner’s retention change rather than applying a generic journal setting that cannot affect the file.
Container-runtime logs
Container logs can be outside the journald path and may grow independently of host policy. Locate their directory with the same du -xhd1 approach, identify the runtime and workload responsible, and change that runtime’s logging policy through its supported configuration. Vacuuming journald does not affect these files.
Be careful with layered or separately mounted container storage. The path that appears large in a directory listing may belong to another filesystem, so confirm it with df -hT before changing runtime settings. Coordinate policy changes with workload owners and verify that the runtime continues collecting logs after the change.
After cleaning any non-journal owner, run df -hT again. If usage does not fall, check lsof +L1 for an open deleted file or confirm that the large directory is on a different mount than the one you intended to clean.
8. A practical incident checklist
- Capture
df -hTand the twoduinventories before making changes. - Confirm the affected mount and whether
/var/log/journalis actually the largest contributor. - Run
journalctl --disk-usage, list boots, and inspect warning-or-higher messages from the current boot. - Choose age, size, or file-count retention that does not violate investigation or compliance requirements.
- Run
journalctl --rotate, then one bounded vacuum command. - Verify with
journalctl --disk-usageanddf -hT; interpret any remaining active-file usage correctly. - Run
lsof +L1and coordinate a service restart if an open deleted file is retaining blocks. - Inspect and correct journald free-space and retention policy, then monitor the next rotation.
- If journald was not large, apply the owning service or container runtime’s supported rotation policy instead.
If the server is close to complete exhaustion, prioritize a measured, reversible action. Capture the outputs first, select the smallest retention reduction that restores operating room, and avoid deleting files whose ownership or evidence value is unknown. Once the immediate risk is over, schedule the policy correction and a follow-up check rather than treating the emergency command as permanent maintenance.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →9. Choosing between age, size, and file count
Age-based retention is easiest to explain during an investigation because every entry older than a stated period is eligible for removal. Size-based retention provides a clearer storage ceiling, which is valuable on small system volumes, but it can shorten the historical window during a logging burst. File-count retention is straightforward to communicate yet offers no reliable byte limit. None of these choices replaces an organisation’s requirement to preserve security or audit records elsewhere.
Use the same criterion in operational documentation, monitoring, and review procedures. If the runbook says “keep 30 days” but the host is managed with a file-count limit, responders cannot predict what evidence remains. If the requirement is a storage ceiling, document that active files can keep the journal total above the archived target and define the verification method using both journal and filesystem measurements.
The most important distinction is ownership: journald’s vacuum controls apply to archived journal files only. If the disk remains full after a correctly bounded vacuum, the next action is measurement and attribution, not a more aggressive journal deletion.
Frequently asked questions
Why did vacuuming not reduce --disk-usage to my requested size?
--disk-usage includes active as well as archived journal files. Vacuum removes archived files, so active files can keep the reported total above the size bound. Rotating first archives the current files and gives vacuum its greatest effect, but new messages can continue arriving.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Should I run --vacuum-time, --vacuum-size, and --vacuum-files together?
Choose the rule that matches your retention requirement and apply one explicit bound for a clear, auditable result. Age explains the historical window, size controls archived storage, and file count limits generations without guaranteeing a byte ceiling.
Is it safe to delete everything in /var/log?
No. Files may belong to different services, may be needed for incident or compliance work, or may remain open after deletion. Identify the owner and use its supported rotation policy. For journald, use a bounded vacuum command instead of an unqualified recursive deletion.
What does lsof +L1 tell me?
It lists open files whose directory entries have been deleted. The process still holds the blocks, so filesystem usage may not fall until that process closes the file. An approved service restart commonly releases them; verify afterward.
What are SystemKeepFree and RuntimeKeepFree?
They are journald controls specifying how much space to leave free for other uses. Review them with the filesystem size, logging rate, and retention obligations in mind, then apply changes through normal configuration and change control.
Why is /var/log still full after cleaning the journal?
The large files may be ordinary service logs, application logs, or container-runtime logs. Re-run the du inventory, confirm the mount with df -hT, identify the owner, and apply that owner’s logging policy. Also check for open deleted files.
Will rotating logs interrupt services?
journalctl --rotate archives the active journal so vacuum can process it. Continue to follow your distribution’s service-availability and change-control procedures, and verify that journald resumes writing after the operation.
How often should I recheck the result?
Run the journal and filesystem measurements immediately after cleanup, then inspect usage again after the next rotation cycle. This confirms that the policy, rather than a one-time deletion, is controlling growth.
Frequently Asked Questions
Can I clear logs without losing all troubleshooting information?
Yes. Select an age, size, or file-count bound that preserves the period your incident and compliance requirements demand, rotate first, and vacuum only archived journal files. Save the pre-cleanup measurements and any evidence needed for the investigation.
Recommended Free Tools
What is the quickest safe command sequence for a full journal?
Measure with df -hT and journalctl --disk-usage, then run journalctl --rotate followed by one bounded command such as --vacuum-time=30d, --vacuum-size=500M, or --vacuum-files=5. Verify with df -hT, the journal usage command, and lsof +L1.
Why does deleting a log file sometimes free no space?
A running process may still have the deleted file open. sudo lsof +L1 identifies those files; an approved restart or other service-specific action is needed before the blocks are released.
The Bottom Line
Measure first, identify the owning mount and log system, rotate journald, and apply one explicit vacuum bound that fits your evidence requirements. Verify both journal and filesystem usage, investigate open deleted files, and set SystemKeepFree or RuntimeKeepFree through change control. If journald is not the largest consumer, use the responsible service or container runtime’s own rotation policy instead.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
