Linux · high · Core system faults

/var full — the journal or logs have consumed the disk

systemd-journald and application logs have filled /var, and services start failing in ways that have nothing obvious to do with disk space.

What you see

Databases refuse writes, services fail to start, sudo may misbehave. df shows /var at 100%.

What is actually wrong

No journal size cap set, logrotate not running or misconfigured, or a single application logging at debug level indefinitely.

Codes and articles

No space left on device/var 100%Journal file corrupted

The fix

Reclaim the space and cap it permanently

Shell as root20 minuteslow riskreversible

/var is full. Do the capping step as well as the clearing step, or you will be back here in a month.

Confirm where the space has gone.

Shell

df -h /varsudo du -xh /var --max-depth=2 2>/dev/null | sort -rh | head -15

Check how much the journal is holding.
Shell
```
journalctl --disk-usage
```
Trim it immediately to reclaim space.
Shell
```
sudo journalctl --vacuum-size=200M
```
Or trim by age instead.
Shell
```
sudo journalctl --vacuum-time=7d
```
Cap it permanently so this cannot recur — set SystemMaxUse=500M in /etc/systemd/journald.conf.
Shell
```
sudo sed -i 's/^#\?SystemMaxUse=.*/SystemMaxUse=500M/' /etc/systemd/journald.confsudo systemctl restart systemd-journald
```
With no cap, journald will use up to 10% of the filesystem. On a large /var that is a lot of logs and on a small one it is enough to fill it.

Check logrotate is actually running and not failing silently.

Shell

systemctl status logrotate.timersudo logrotate -d /etc/logrotate.conf 2>&1 | tail -30

Find any single enormous log file that logrotate is not covering.
Shell
```
sudo find /var/log -type f -size +100M -exec ls -lh {} \;
```

Confirm it worked/var has free space and the journal is within its cap.

Shell

df -h /var && journalctl --disk-usage

If you need to undo itVacuumed journal entries are gone permanently. The configuration change is reversible by editing journald.conf back.

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.