Keeping systemd-journald Predictable on Small Root Volumes

On small cloud instances with a 10 GB root filesystem, unconfigured system logs rarely fail loudly—instead they quietly consume 1–2 GB over a few months until package upgrades or temporary files hit ENOSPC.

Set Hard Upper Bounds in journald.conf

Rather than leaving retention strictly to percentage defaults, setting explicit drop-in limits keeps disk consumption bounded regardless of bursty daemon output:

# /etc/systemd/journald.conf.d/90-limits.conf
[Journal]
SystemMaxUse=200M
SystemKeepFree=1G
SystemMaxFileSize=32M
MaxRetentionSec=14day
Compress=yes

Reload the daemon and apply immediate vacuuming once so existing segments shrink right away:

systemctl restart systemd-journald
journalctl --disk-usage
journalctl --vacuum-size=200M

Why SystemKeepFree Matters

Even with SystemMaxUse enabled, specifying SystemKeepFree=1G tells journald to stop writing persistent files if another service spikes disk usage, preserving headroom for APT, SQLite WAL files, or emergency shell access.

Pair this with journalctl --verify during quarterly maintenance to confirm sealed journal segments remain clean.