Find when journald is dropping messages, see why, and tune the limits with a few commands. 12.12.2025 | reading time: 2 min When a runaway service floods the log stream, systemd-journald applies rate limiting; this guide shows how to spot suppressed messages with `journalctl`, inspect the journald configuration, and safely tune the limits to regain useful logs. A quick troubleshooting drill Scenario: a daemon suddenly emits thousands of lines and you miss events; run `sudo journalctl -u mydaemon -f` to observe live, then search for suppression reports with `journalctl -u systemd-journald --since '10 minutes ago' | grep -Ei 'suppress|rate'` and you may see entries like "systemd-journald[123]: Suppressed 128 messages"; check current config with `grep -i rate /etc/systemd/journald.conf` and, to change behaviour, set `RateLimitIntervalSec=30s` and `RateLimitBurst=200` in `/etc/systemd/journald.conf` then `sudo systemctl restart systemd-journald` to apply. What the main knobs do Two options control limits: `RateLimitIntervalSec` is the time window and `RateLimitBurst` is how many messages are allowed inside that window; lowering the interval or the burst tightens suppression, while raising burst or lengthening the interval lets more messages through; use `journalctl --disk-usage` to check storage and `journalctl --vacuum-size=500M` to reclaim space after changing logging behaviour. Other inspection techniques If suppression entries are rare, broaden the search with `journalctl -b` or specific priorities like `journalctl -p err..alert` and probe the source unit with `systemctl status mydaemon`; for persistent capture consider forwarding to a central collector or enabling persistent storage in `/etc/systemd/journald.conf` to avoid losing context when limits kick in. Wrap-up and next steps Detecting and tuning journal rate limiting prevents silent loss of critical events and keeps the system observable; try reproducing a flood in a VM, adjust `RateLimitIntervalSec` and `RateLimitBurst`, and monitor `systemd-journald` output to learn the trade-offs between noise and information; keep exploring Linux logging to build reliable systems and consider formal study like CompTIA Linux+ or LPIC-1 with intensive prep at bitsandbytes.academy. Join Bits & Bytes Academy First class LINUX exam preparation. utilities processes troubleshooting
