Configuring systemd-journald: Linux Log Management and Compression

Why Optimize systemd-journald

The Linux system journal collects kernel, service, application, and audit events into a unified format. Without explicit limits, the journal can grow to several gigabytes, especially on high-load servers or devices with small SSDs. Properly configuring systemd-journald ensures system stability, conserves disk space, and speeds up incident analysis through compression and clear log rotation.

Prerequisites and Preparation

Before you begin, ensure you have:

• Access to an account with sudo or root privileges.
• A distribution using systemd (virtually all modern Linux distros).
• A backup of important logs if you plan to reduce their retention period.

Check the current status and disk usage:

journalctl --disk-usage

The command will show the total size of archived and active storage. If the /var/log/journal/ directory exists, the service is already persisting logs to disk. If it doesn't, logs are stored only in RAM and will be lost upon reboot.

Step 1: Creating a Safe Configuration File

Do not edit /etc/systemd/journald.conf directly. Your changes may be overwritten during a distribution upgrade. Instead, use the drop-in directory mechanism:

sudo mkdir -p /etc/systemd/journald.conf.d
sudo touch /etc/systemd/journald.conf.d/override.conf

The override.conf file will be automatically loaded by the main configuration file, preserving the priority of your custom settings.

Step 2: Configuring Size, Rotation, and Compression

Open the created file in your preferred text editor:

sudo nano /etc/systemd/journald.conf.d/override.conf

Add the following configuration block. The parameters are documented directly in the code so you understand what each line does:

[Journal]
# Storage mode: persistent (to disk), volatile (RAM only), auto (default)
Storage=persistent

# Maximum total size of all archived logs on disk (e.g., 500M, 2G)
SystemMaxUse=500M

# Guaranteed minimum free space on the partition where logs are stored
SystemKeepFree=100M

# Maximum size of a single journal file before rotation
SystemMaxFileSize=50M

# Log retention period: 1month, 1y, 1year, etc.
MaxRetentionSec=1month

# Enable log compression (saves 50-70% space, minimal CPU overhead)
Compress=yes

# Disable forwarding logs to syslog (prevents duplicate entries in /var/log/syslog)
ForwardToSyslog=no

💡 Tip: The SystemMaxUse value should be less than the total size of the / or /var/log partition. If left empty, journald defaults to 10% of the partition or 4 GB (whichever limit is reached first).

Step 3: Applying Changes and Restarting the Service

After saving the file, verify the configuration syntax:

sudo systemd-analyze verify /etc/systemd/journald.conf

If the command returns no errors, restart the journaling service:

sudo systemctl restart systemd-journald

⚠️ Important: During the restart, a few log lines may be temporarily lost as the service recreates file descriptors. For production workloads, it is recommended to perform this operation during off-peak hours.

Verifying the Results

Verify that the service is running correctly:

systemctl status systemd-journald

The output should show the status active (running). Next, check if the new limits have been applied by cleaning up old entries:

sudo journalctl --vacuum-time=7d
sudo journalctl --disk-usage

The --vacuum-time command will remove all archives older than the specified date, instantly freeing up space. Verify that the files physically exist in the directory:

ls -lh /var/log/journal/

You should see compressed files with the .journal extension (or .zst in newer systemd versions).

Troubleshooting

Service fails to start after reboot. This is usually caused by a typo in a parameter name or an invalid value in override.conf. Check the error logs: sudo journalctl -xeu systemd-journald. Fix the value and run sudo systemctl daemon-reload && sudo systemctl restart systemd-journald.

Logs are missing or not being written to disk. Check the Storage=persistent parameter. If you accidentally set it to volatile, data is stored in /run/log/journal/ and disappears on reboot. Also, ensure the /var/log/journal/ directory has the correct permissions: sudo chown root:systemd-journal /var/log/journal/ and sudo chmod 2755 /var/log/journal/.

Disk still fills up despite SystemMaxUse. This parameter only applies to new entries. If old archives already occupy 10 GB, a 500 MB limit will not automatically delete them. Perform a forced cleanup: sudo journalctl --vacuum-size=400M.