How to Stop Ubuntu from Automatically Emptying Systemd Journal Logs (journalctl)

Modern Ubuntu Linux distributions use systemd as their initialization system, which includes a centralized logging daemon known as systemd-journald. Whenever a service starts, a process crashes, or the kernel reports an error, it is logged into the journal and can be viewed using the journalctl command.

Because these logs can grow incredibly large on busy servers, Ubuntu is configured by default to automatically rotate and delete old logs to prevent your hard drive from filling up. By default, journald will automatically cap its disk usage at 10% of your file system and will violently purge older log entries to stay under this limit.

If you are trying to perform a deep forensic analysis of a server crash that happened three weeks ago, you may find that Ubuntu has already deleted the critical logs. To perform long-term auditing, you must configure journald to retain a much larger archive.

How to Increase the Journal Retention Limit

You can modify the automatic deletion rules by editing the main journald configuration file.

1. Open your terminal application (Ctrl+Alt+T) or connect via SSH.
2. Open the configuration file in a text editor with root privileges (using nano):

sudo nano /etc/systemd/journald.conf

3. Look for the line that says #SystemMaxUse=. (The # means it is currently commented out, relying on the default 10% rule).
4. Remove the # symbol to uncomment the line.
5. Change the value to a hard limit that suits your server size, for example, 10 Gigabytes:

SystemMaxUse=10G

6. (Optional) If you want to retain logs based on time rather than size, find the #MaxRetentionSec= line, uncomment it, and set it to your desired timeframe (e.g., MaxRetentionSec=1year).
7. Save the file in nano (Ctrl+O, Enter) and exit (Ctrl+X).
8. Restart the journald service to apply the new rules:

sudo systemctl restart systemd-journald

The systemd journal will now respect your new boundaries. It will still eventually delete old logs, but only after it hits your massive 10GB limit (or 1-year timeframe), ensuring your historical data remains intact for forensic auditing.