Keep the systemd journal across reboots and cap its size

By default some systemd distributions keep the journal only in memory, so the logs you most need after a crash disappear with the reboot. This guide makes the journal persistent and puts a limit on the disk it may use.

Prerequisites#

• A Linux system running systemd with systemd-journald.
• Root access or sudo.
• Enough free disk space for the size limit you choose (check with df -h /var).

Steps#

1. Check the current state. Note how many boots are listed and how much space the journal uses:

   Bash

   Copy

   journalctl --list-boots
   journalctl --disk-usage
   

2. Create the persistent storage directory. With the default Storage=auto, journald stores logs on disk only when this directory exists:

   Bash

   Copy

   sudo mkdir -p /var/log/journal
   

3. Open the journald configuration drop-in for editing (preferred over editing the main file, so package updates do not overwrite your change):

   Bash

   Copy

   sudo mkdir -p /etc/systemd/journald.conf.d
   sudo nano /etc/systemd/journald.conf.d/50-persistent.conf
   

4. Add these lines, adjusting the size to suit the disk:

   INI

   Copy

   [Journal]
   Storage=persistent
   SystemMaxUse=500M
   

   Storage=persistent stores logs under /var/log/journal (creating it if needed). SystemMaxUse= caps the total disk space used by the journal.

5. Restart the journal service:

   Bash

   Copy

   sudo systemctl restart systemd-journald
   

6. Optionally move the existing in-memory logs to disk straight away:

   Bash

   Copy

   sudo journalctl --flush
   

Verify it worked#

1. Confirm journal files exist on disk:

   Bash

   Copy

   ls /var/log/journal/*/
   

2. Confirm usage is reported and under your cap:

   Bash

   Copy

   journalctl --disk-usage
   

3. After the next reboot, confirm more than one boot is listed:

   Bash

   Copy

   journalctl --list-boots
   

4. Read the previous boot's errors:

   Bash

   Copy

   journalctl -b -1 -p err
   

Trim the journal manually (optional)#

To free space immediately, remove old archived entries by size or age:

sudo journalctl --vacuum-size=500M
sudo journalctl --vacuum-time=30d

Undo#

1. Remove the drop-in file:

   Bash

   Copy

   sudo rm /etc/systemd/journald.conf.d/50-persistent.conf
   

2. If you want logs back in memory only, remove the stored journal and the directory (this deletes the saved logs):

   Bash

   Copy

   sudo rm -r /var/log/journal
   

3. Restart the service:

   Bash

   Copy

   sudo systemctl restart systemd-journald
   

Troubleshooting#

• Only one boot is listed after a reboot: confirm /var/log/journal exists and that the restart in step 5 succeeded (systemctl status systemd-journald).
• A setting seems ignored: drop-in files are read in alphabetical order and later files win; check for other files with systemd-analyze cat-config systemd/journald.conf.
• Distribution defaults differ: some distributions already enable persistent storage. If step 1 already lists several boots, no change is needed.

For the full list of options, see man journald.conf and man journalctl.