What Is systemd-journald and Should You Limit Its Log Size?

When I was troubleshooting memory issues on my Ubuntu VPS, I noticed something unexpected.

One of the largest processes on the server was not Java, PostgreSQL, or Nginx.

It was:

systemd-journald

At first, I thought something was wrong.

Why would a logging service use hundreds of megabytes of memory?

After spending some time reading the documentation and checking my server, I realized that the behavior was mostly normal.

This article explains what systemd-journald does, how it works, and whether you should limit its log usage on a small VPS.

What Is systemd-journald?

systemd-journald is the logging service included with modern Linux distributions that use systemd.

It collects logs from:

• system services
• application services
• kernel messages
• SSH login attempts
• cron jobs
• Docker containers
• systemd units

Instead of reading log files directly, many administrators use:

journalctl

to access logs stored by journald.

For example:

journalctl -u nginx

shows logs from Nginx.

journalctl -u blog

shows logs from a Spring Boot service.

What Is the Difference Between journalctl and journald?

Many people confuse these two terms.

Think of them this way:

systemd-journald = logging service
journalctl       = log viewer

Journald collects and stores logs.

Journalctl reads and displays them.

You can think of journalctl as a command-line interface for journald.

Why Does Journald Use Memory?

This is usually the first question people ask.

Journald does not immediately write every log message to disk.

Some data is kept in memory for performance reasons.

This helps:

• reduce disk activity
• improve logging speed
• avoid excessive writes

On small VPS instances, it is not unusual to see journald using tens or even hundreds of megabytes of RAM.

In my case, the process was using around 290 MB.

That looked alarming at first, but it was not the root cause of my server problems.

How to Check Journal Size

To see how much space journals use:

journalctl --disk-usage

Example:

Archived and active journals take up 420M on disk.

This command is useful when troubleshooting storage usage.

Should You Limit Journal Size?

For most servers, the default settings are acceptable.

However, if you run a small VPS with limited resources, it may be worth setting reasonable limits.

I usually configure something similar to:

SystemMaxUse=200M
RuntimeMaxUse=100M
MaxRetentionSec=7day

This keeps enough history for troubleshooting while preventing logs from growing indefinitely.

How to Configure Journal Limits

Open the configuration file:

sudo nano /etc/systemd/journald.conf

Add or modify:

SystemMaxUse=200M
RuntimeMaxUse=100M
MaxRetentionSec=7day

Restart journald:

sudo systemctl restart systemd-journald

Does Limiting Journald Have Any Risks?

Yes, but the risk is usually small.

The main trade-off is log retention.

With aggressive limits, older logs may disappear sooner.

For example:

• 30 days of history might become 7 days
• 7 days might become 3 days

The application itself is not affected.

PostgreSQL, Nginx, and Spring Boot continue to work normally.

The only thing you lose is older troubleshooting information.

My Recommendation for Small VPS Servers

For a personal project running:

• Spring Boot
• PostgreSQL
• Nginx
• Ubuntu

on a 2GB VPS, I would:

• keep journald enabled
• keep log retention reasonable
• avoid extremely small limits
• review log growth occasionally

In most cases, journald is not the problem.

It is simply doing its job.

The real challenge is understanding what the logs are trying to tell you.