# Account for active files when estimating journal vacuum results

> A vacuum limit applies to archived journal files rather than the entire disk-usage display.

- Canonical URL: https://update.dsesecurity.com/updates/account-for-active-files-when-estimating-journal-vacuum-results/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:15:29+00:00
- Modified: 2026-10-20T18:34:33+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A vacuum limit applies to archived journal files rather than the entire disk-usage display.

## Potentially affected

Review journalctl archived-file vacuum limits and rotation using the Debian trixie manual.

## DSE recommendation

DSE recommends preserving incident evidence and confirming retention obligations before vacuuming.

## Article

A vacuum limit applies to archived journal files rather than the entire disk-usage display.

## Source facts

The Debian journalctl manual states that --disk-usage includes active and archived journal files. Vacuum options remove archived files, so their size or file-count target may not reduce total displayed use below that value. Combining rotation with vacuum first archives active files, making more existing data eligible for the requested cleanup.

Source: [Debian systemd manual — journalctl(1) — systemd — Debian trixie — Debian Manpages](https://manpages.debian.org/trixie/systemd/journalctl.1.en.html).

## Applicability

Review journalctl archived-file vacuum limits and rotation using the Debian trixie manual.

## DSE recommendation

DSE recommends preserving incident evidence and confirming retention obligations before vacuuming. Explain the difference between active and archived use when estimating reclaimed space. Prefer documented journal controls over deleting files manually. Keep emergency cleanup distinct from a lasting size policy, and investigate why the journal grew unexpectedly. If rotation is needed, review its effect on the data eligible for deletion rather than adding it blindly to a disk-space command copied from another server.

## Verification

In an isolated journal store, compare disk usage, active files, and archived files before a safe retention exercise. Apply only an approved test limit and inspect the result. Confirm expected historical queries still work through the retained archive and that production monitoring uses the correct total-space interpretation. Retain the active/archived file inventory and exact requested limit with the result. Have the log owner approve the historical interval retained in the exercise and explain any remaining active-file contribution to total use.

## Official reference

[Debian systemd manual — journalctl(1) — systemd — Debian trixie — Debian Manpages](https://manpages.debian.org/trixie/systemd/journalctl.1.en.html). Reviewed October 20, 2026.

## Primary reference

- Name: Debian systemd manual — journalctl(1) — systemd — Debian trixie — Debian Manpages
- Authority: manpages.debian.org
- URL: https://manpages.debian.org/trixie/systemd/journalctl.1.en.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Account for active files when estimating journal vacuum results,” DSE Security, https://update.dsesecurity.com/updates/account-for-active-files-when-estimating-journal-vacuum-results/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.