Categories

Fix High CPU Usage from systemd-journald and/or rsyslogd on Linux Mint

Donate with

Donate BAT now

Verified BAT publisher

Why Your Linux Mint Feels Slow - and systemd-journald Might Be to Blame

If your Linux Mint system suddenly feels sluggish or uses a lot of processing power without really doing anything and you notice systemd-journald or rsyslogd consuming a lot of CPU power, you’re dealing with a common issue: log flooding. These daemons handle system logging, and when a service or driver starts producing excessive log messages, they can easily overload your CPU and disk I/O.

What systemd-journald and rsyslogd Do

Understanding their roles helps you troubleshoot effectively:

• systemd-journald: Collects logs from the kernel, user-space services, and the systemd infrastructure itself.
• rsyslogd: Reads logs (often from journald) and writes them to files in /var/log for long-term storage or forwarding.

Under normal conditions, both processes are lightweight. High CPU usage typically means that something is logging excessively or that there’s a configuration loop between journald and rsyslog.

Step 1 — Check Which Service Is Spamming Logs

Run this command to see which services have been most active in the last two minutes:

sudo journalctl -p info --since "2 minutes ago" | awk '{print $5}' | sort | uniq -c | sort -nr | head

You’ll see an output like this:

82325 brltty[833022]:
   12 systemd-journald[350]:
   11 kernel:

The service with the highest count is usually the cause. In many cases it could be:

• brltty: The Braille display service, logging connection errors repeatedly
• NetworkManager: Looping over failed network connections
• bluetoothd: Constantly attempting to reconnect to a missing Bluetooth device
• kernel: Spamming hardware or driver warnings

Any of these can generate thousands of log lines per minute, overwhelming the system logger.

Step 2 — Inspect Recent Logs in Real Time

To see what’s being logged right now, run:

sudo journalctl -f

If messages are flying by quickly or repeating endlessly, that confirms the issue.

Step 3 — Investigate the Suspect Service

Once you know which process is the culprit, check its dedicated logs. For example:

sudo journalctl -u bluetooth -n 50
sudo journalctl -u NetworkManager -n 50
sudo journalctl -u brltty -n 50

This helps identify the specific error message that’s repeating and flooding the system log.

Step 4 — Apply the Fix

Option 1 — Disable or Restart the Misbehaving Service

If the issue comes from a non-essential service, you can disable it:

sudo systemctl stop brltty
sudo systemctl disable brltty

or restart it if it’s needed:

sudo systemctl restart NetworkManager
sudo systemctl restart bluetooth

Option 2 — Update Drivers or Firmware

In some cases (especially for Wi-Fi, USB, or GPU), kernel or driver issues may produce endless errors. Updating your system can stop these:

sudo apt update && sudo apt upgrade -y

Step 5 — Clean Up and Limit Log Sizes

After fixing the cause, trim existing logs to free space and reset journald:

sudo journalctl --vacuum-size=200M
sudo systemctl restart systemd-journald rsyslog

You can also limit journald’s future disk usage by editing /etc/systemd/journald.conf:

SystemMaxUse=200M
RateLimitIntervalSec=30s
RateLimitBurst=1000

Then restart the service:

sudo systemctl restart systemd-journald

Step 6 — Check for Logging Loops Between journald and rsyslog

If both journald and rsyslog are active, they can sometimes loop messages. Inspect /etc/rsyslog.conf and /etc/rsyslog.d/50-default.conf for something like:

*.* @localhost

Comment out or remove such entries if found, then restart rsyslog:

sudo systemctl restart rsyslog

Quick Troubleshooting Checklist

• Use journalctl -f to detect repeating messages
• Identify the noisiest service with awk and sort
• Disable or fix the offending service
• Vacuum logs with journalctl --vacuum-size
• Adjust journald rate limits for the future

Conclusion

High CPU usage by systemd-journald and rsyslogd is usually a symptom, not the root cause. By finding which service is spamming logs — whether it’s brltty, NetworkManager, bluetoothd, or a kernel driver — you can restore your Linux Mint system to peak performance in minutes. Once the culprit is fixed, journald and rsyslogd will return to their normal lightweight behavior.