Recommended Free Tools
A sudo session count cannot explain why logs occupy nearly 10 GB: a session may create a small command-event record or, if input/output recording is enabled, much larger stream recordings. The right first step is to find the exact path using the space. Without the machine’s distribution, sudo version, and file path, the cause of this particular growth cannot be identified.
Why sudo session count does not measure log size
sudo can record command events, and policy can separately enable input/output (I/O) logging. Event records describe commands and related metadata; I/O recordings can capture terminal keystrokes, output, and standard streams. Their storage use varies with what is recorded and how much activity occurs, so two sessions need not produce similar amounts of data.
As an Amazon Associate I earn from qualifying purchases.
The sudoers documentation describes optional recording of terminal input, terminal output, standard input, standard output, and standard error. Local I/O logs default to /var/log/sudo-io in the sudo 1.9.14 manual; check the installed version and policy because defaults and configuration can differ. sudo log lines may include unique session IDs such as TSID=, but counting those IDs still does not tell you how many bytes the recordings use.
Find the path that is consuming the space
Start with the filesystem’s normal disk-usage tools and identify the largest file or directory, including its full path. Do not delete a file merely because its name contains “sudo,” and do not vacuum the journal just because the problem is described as sudo logs. The path identifies which service and retention controls to investigate.
#1 Best Overall
These stores are not interchangeable: the systemd journal, sudo’s I/O recordings, ordinary text logs, and Linux Audit logs have different owners and cleanup mechanisms.
| Store | What it contains | What to check |
|---|---|---|
| systemd journal | Journal records from system services | Journal usage and archived-file vacuuming; active files count toward displayed usage. |
| sudo I/O log directory | Recorded command-session input/output, when enabled | sudo policy, recording settings, directory size, and I/O-log sequence limits. |
| Ordinary text log | Messages written by a daemon or application | The logrotate configuration for that specific file and whether rotation runs. |
| Audit log | Linux Audit records written by auditd | auditd size-based rotation and configured retention. |
If the large path is the systemd journal
Run journalctl --disk-usage to see the combined disk use of active and archived journal files. If you need to reduce archived journal storage, journalctl --vacuum-size=SIZE removes the oldest archived files until the archived portion is below the specified size. The displayed total includes active files, which vacuuming does not remove. If active files are preventing the result you expect, rotate first, then vacuum; rotation makes the current journal files archived and eligible for vacuuming.
Choose a limit that still preserves the history needed for troubleshooting, security review, and any applicable retention requirements. A vacuum target is not a promise that total journal usage will fall to exactly that size, because active files remain outside the vacuum operation.
If the large path is sudo’s I/O log directory
Inspect the active sudoers policy for settings or command tags that enable input or output recording. Confirm the local sudo version and the configured I/O log directory before changing anything. Traditional log rotation utilities are designed for configured log files; they do not directly cap sudo’s per-session I/O directory structure.
The sudoers manual documents maxseq as a way to bound the I/O-log sequence and reuse existing logs. Treat that as a retention decision, not a generic disk cleanup switch: reuse can remove older recordings that may be needed for an audit or incident investigation. Check the policy syntax and retention obligations for your installation before applying it.
Consider the sensitivity of captured input
sudo’s manual warns: “User input may contain sensitive information such as passwords (even when they are not echoed to the screen), which will be stored in the log file unencrypted.” If input recording is enabled, consider who can access those files and how long the organization must retain them. Do not enable broad input capture merely to improve accounting of sessions.
Rank #4
If the large path is an ordinary text log
Identify the daemon or application writing the file, then inspect the logrotate stanza that covers that exact path. logrotate can apply scheduled or size-based rotation, compression, deletion, and other handling, but only to logs included in its configuration.
- Confirm the file is covered by a logrotate configuration.
- Check the rotation trigger, such as a time interval or size threshold.
- Check compression and how many rotated files are retained.
- Verify the scheduled timer or cron job that runs logrotate is operating.
Changing logrotate settings will not limit systemd journal storage or sudo’s per-session I/O directory.
Best Value
If the large path is an audit log
Linux Audit records are written to disk by auditd. Its configuration uses size-based rotation by default; max_log_file_action and num_logs are among the settings that affect rotation and retention. Confirm that auditd owns the file before changing these values, and preserve the records required for security investigations or compliance.
Choose a fix based on the bytes and the retention need
Once the path is known, match it to its owner and content, then adjust only that store’s controls. The useful questions are whether the space is active or archived data, what triggers rotation, how many files or recordings are retained, and whether those records contain sensitive information or are needed later. Session counts answer none of those byte-accounting questions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
