Logging & Journald

Find out who is spamming your system logs before the disk fills up

🧩 The Challenge

You get that 3 AM page about a disk space warning and find half your storage is just garbage logs from a rogue process looping an error. Figuring out which service is the culprit usually means digging through millions of lines of text manually, which is a complete nightmare.

💡 The Fix

Use a quick journalctl query to rank services by the sheer volume of log entries they generate. It highlights the biggest offenders in seconds so you can fix the underlying mess.

journalctl -F _SYSTEMD_UNIT | xargs -I {} sh -c 'printf "%s: " "{}"; journalctl -u "{}" --since "1 hour ago" | wc -l' | sort -nr -k2

⚙️ Why It Works

This chain pulls every unique unit name from the journal, counts the entries for each one over the last hour, and sorts them numerically. Seeing the actual counts makes it painfully obvious which service is acting like a runaway chainsaw.

🚀 Pro-Tip: Pipe that into head -n 5 to skip the noise and jump straight to the top talkers.

Linux Tips & Tricks | © ngelinux.com | 7/14/2026