Linux Survival Basics
Read-only, can be slowCheck systemd Journal Disk Usage
Disk alerts often lead people to delete the wrong files without checking whether the systemd journal is the real consumer.
Command
journalctl --disk-usageBefore you run this
System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.
When not to use it: Do not use it to find application log directories outside journald.
Expected output
A total size for archived and active systemd journal files. The number is measured usage, not a promise that all of it is safe to reclaim.
System impact
Read-only, can be slow. Nothing changes. journalctl reports the total disk used by archived and active journal files.
Scope this to the smallest useful path or service on busy systems.
Recovery / rollback: no state is changed.
When to use it
Use during disk-space triage before deciding whether journal retention needs adjustment.
When not to use it
Do not use it to find application log directories outside journald.
What the number means
Use this number to decide whether journal storage is material compared with the full filesystem. It does not identify which service is noisy.
journalctl --disk-usagedu -sh /var/log/journal 2>/dev/null
Retention warning
Vacuuming journals deletes log history. Capture incident evidence and retention requirements before running a vacuum command.
journalctl --disk-usagejournalctl -p err..alert --since "2 hours ago" --no-pager
next steps
Related commands
Spot OOM Kills in the Kernel Journal
Exit code 137 often means the kernel has something to say.
journalctl -k --since "2 hours ago" --no-pager -o short-iso | grep -Ei 'out of memory|oom|killed process'
Read Mount and fstab Warnings
The boot journal often names the mount or dependency that failed.
journalctl -b -p warning --no-pager | grep -iE 'mount|fstab|dependency'
Read Recent systemd Timer Logs
Timer logs show whether systemd attempted to trigger the task.
journalctl -u backup.timer --since "24 hours ago" --no-pager
Read Recent Logrotate Journal
The journal can show why rotation skipped.
journalctl -u logrotate --since '7 days ago' --no-pager
Read Current-Boot Logs for One Service
Ignore stale logs and inspect only what happened since this boot.
journalctl -u nginx -b --no-pager -n 80
next diagnostic step
Where to go from this command
- Journal logs too large problem hub Use when journal storage contributes to disk pressure.
- Linux disk full hub Use when journal growth is part of a larger disk-full incident.
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.