Journalctl Disk Usage Calculator
Estimate actual systemd journal disk usage given a log generation rate, retention period and SystemMaxUse cap.
Inputs
The journald.conf SystemMaxUse cap, 0 means unlimited (uses default 10% of filesystem)
Actual Disk Usage
4,096.00MB
Days of Logs Actually Retained
20.5days
Desired Usage (rate × retention)
6,000.00MB
Status
Capped by SystemMaxUse — only ~20.5 days of logs will actually be retained, not 30
Step by step
Values used
Log Generation Rate = 200 MB/day; Desired Retention Period = 30 days; SystemMaxUse Setting = 4,096 MB
Actual journal disk usage
actual_usage = min(log_rate × retention_days, SystemMaxUse)
Actual Disk Usage
= 4,096.00 MB
Days of Logs Actually Retained
= 20.5 days
Desired Usage (rate × retention)
= 6,000.00 MB
Status
= Capped by SystemMaxUse — only ~20.5 days of logs will actually be retained, not 30
How it works
journald continuously trims its own storage to stay within the SystemMaxUse ceiling configured in journald.conf, rotating out the oldest entries first once that cap is reached — regardless of how long an administrator might want logs retained. This means the actual disk usage is the smaller of the desired usage (log generation rate multiplied by the intended retention period) and the configured cap: if the cap is smaller than the desired usage, the effective retention window shrinks silently, which is a common surprise when diagnosing 'why did my logs from last week disappear' issues.
Formula
Actual journal disk usage
actual_usage = min(log_rate × retention_days, SystemMaxUse)
- r
- log generation rate per day
- d
- desired retention in days
- M
- SystemMaxUse cap
Frequently Asked Questions
What happens when journald reaches SystemMaxUse?
journald automatically vacuums (deletes) the oldest journal entries to make room for new ones, keeping total usage at or below the configured cap — it does not fail or block logging, but old history is silently lost once the space limit is reached.
What is the default SystemMaxUse if I don't configure it?
If unset, journald defaults to using up to 10% of the filesystem it is stored on (typically /var/log/journal), with additional built-in limits like leaving at least 15% of the filesystem free — check journalctl --disk-usage and man journald.conf for the exact defaults on your distribution.
How do I retain logs longer without expanding local disk?
Forward logs to a centralized log aggregator (rsyslog, Loki, Elasticsearch, a SIEM) via journald's forwarding options or a log shipper, so long-term retention lives on remote storage while the local journal stays small and fast to query.