How to Stop Ubuntu from Automatically Emptying the Systemd Journal Logs (Increase Log Retention)

Modern Linux distributions, including Ubuntu, rely on systemd to manage background services and system initialization. A core component of this system is systemd-journald, a service responsible for collecting and storing log data from the kernel, system services, and applications. You typically interact with these logs using the journalctl command.

By default, Ubuntu configures the journal daemon to be quite aggressive with its cleanup routine to ensure logs do not consume too much disk space on smaller hard drives. Often, it caps the maximum log size to a relatively small percentage of the file system (usually around 10% or a maximum of 4GB). Once this limit is reached, older logs are automatically rotated out and permanently deleted.

If you are running a production server or diagnosing a complex, long-running bug that spans several weeks, this automatic deletion can result in crucial historical logs being wiped before you have a chance to review them.

How to Increase Systemd Journal Log Retention

To stop Ubuntu from automatically emptying your older logs, you need to manually override the default limits in the journald.conf file.

1. Open your terminal application or connect to your server via SSH.
2. Open the journal daemon configuration file in a text editor (like nano) with sudo privileges:

sudo nano /etc/systemd/journald.conf

3. Look for the section containing settings like SystemMaxUse= and SystemMaxFileSize=. These lines are usually “commented out” with a hashtag (#) at the beginning, meaning the system is currently using its hidden default values.
4. To set your own hard limit (for example, to allow the logs to grow up to 10 Gigabytes before older entries are deleted), remove the hashtag from the beginning of the SystemMaxUse line and modify it to look like this:

SystemMaxUse=10G

5. If you want to ensure logs are kept for a specific amount of time regardless of size (e.g., you must retain logs for 6 months for compliance reasons), uncomment the MaxRetentionSec line and define a time limit:

MaxRetentionSec=6month

6. Save the file and exit the text editor (in nano, press Ctrl+O, Enter, then Ctrl+X).
7. Finally, restart the journal daemon to apply your new rules immediately:

sudo systemctl restart systemd-journald

Your Ubuntu system will now respect these new upper bounds, preserving your historical logs for much longer before automatically deleting them.