Logging & Journald

Stop log rotation from deleting the proof you actually need

🧩 The Challenge

You finally catch a service crashing, but by the time you SSH in the next morning, systemd has already rotated the logs and nuked the evidence. I’ve wasted way too many hours chasing ghosts because the default retention is basically non-existent.

💡 The Fix

Use journalctl’s vacuuming commands to force the system to hang onto logs based on file size or time, keeping your history safe from automatic cleanup. It is a lifesaver when you are trying to debug a intermittent service death that only happens at 3 AM.

journalctl --vacuum-time=7d
journalctl --vacuum-size=1G

⚙️ Why It Works

These commands manually prune the binary journal files until they fall under the specified retention threshold, ensuring you keep exactly the amount of history you can actually afford to store. You are basically taking manual control away from the aggressive default auto-rotation settings.

🚀 Pro-Tip: Edit /etc/systemd/journald.conf and set MaxRetentionSec to stop this from happening again next month.

Linux Tips & Tricks | © ngelinux.com | 10/15/2026