Ubuntu utilizes the systemd-journald service to collect and manage system logs. Every time a service starts, a cron job executes, or a hardware error occurs, it is logged into the journal. Over months of heavy use, these log files can grow significantly in size. To prevent your hard drive from filling up with text files, Ubuntu automatically rotates these logs, deleting the oldest entries once the journal reaches a specific size limit (usually around 10% of your disk space) or a specific time limit (like 4 weeks).
However, if you are running a high-security server and you are required by compliance regulations (like HIPAA or PCI DSS) to maintain years of historical log data for auditing purposes, Ubuntu’s automatic cleanup routine is a massive liability. If the system deletes old logs, you lose your audit trail.
You can edit the journal daemon configuration to make the log retention permanent, ensuring Ubuntu never deletes historical data.
How to Stop Journalctl from Deleting Old Logs
You must configure the journald daemon to use a massive size limit and an infinite time limit.
- Open your terminal application (
Ctrl+Alt+T) or SSH into your server. - Open the journald configuration file in a text editor with root privileges:
sudo nano /etc/systemd/journald.conf
- Look through the file for the following commented-out parameters:
#SystemMaxUse=
#MaxRetentionSec=
- Uncomment the lines by removing the
#symbol. - Change the values to effectively disable the limits. For example, set the max size to a massive number (like 500 Gigabytes) and set the retention time to 0 (which means infinite):
SystemMaxUse=500G
MaxRetentionSec=0
- Press
Ctrl+O, thenEnterto save the file. - Press
Ctrl+Xto exit the editor. - Restart the journal daemon to apply the changes immediately:
sudo systemctl restart systemd-journald
Your Ubuntu server will now retain every single log entry indefinitely, up to the massive 500GB limit you specified, ensuring your historical audit trails remain intact.