OpenClaw Log Rotation and Disk Growth: A Practical Fix

Where OpenClaw disk usage comes from

Most "OpenClaw ate my disk" reports trace back to four places, and only one of them is a log file in the traditional sense. Typical installs under ~/.openclaw/ keep a gateway log that grows with every inbound message, a session store of JSONL transcripts, and a media cache holding attachments pulled from chat platforms.

Growth source	Typical location	Rotation method
Gateway log	`~/.openclaw/logs/gateway.log`	logrotate, daily + maxsize
Session transcripts	`~/.openclaw/sessions/`	age-based `find -delete`
Attachment / media cache	`~/.openclaw/media/`	scheduled prune by mtime
systemd journal & container layers	`/var/log/journal`, `/var/lib/docker`	journald caps, `docker system prune`

The transcripts are the sleeper. A busy agent with verbose tool-call logging can write megabytes per conversation, and those files never shrink on their own.

Where we host this site

The plan behind Hosting Notes

Same 4 GB VPS and LiteSpeed stack we benchmark in these guides.

See Hostinger plans

Find the growth in 60 seconds

Start with the filesystem, then drill into the OpenClaw home. Running as the service user matters. sudo du on another account can miss permission-denied subdirectories and give you a false total.

df -h /
du -xh --max-depth=2 ~/.openclaw | sort -rh | head -20
ls -lh ~/.openclaw/logs/

If df reports space used but du adds up to far less, a deleted-but-still-open file is being held by a running process. Restart the gateway before chasing phantom usage.

A logrotate rule for the gateway log

OpenClaw keeps its log file descriptor open, so a rule that renames the file will keep writing to the old inode. Use copytruncate unless you are prepared to restart the gateway in a postrotate hook.

/home/openclaw/.openclaw/logs/gateway.log {
    daily
    rotate 14
    maxsize 100M
    missingok
    notifempty
    compress
    delaycompress
    copytruncate
}

Drop it in /etc/logrotate.d/openclaw, then verify with sudo logrotate --debug /etc/logrotate.d/openclaw before trusting it. The maxsize directive is the important one: it rotates mid-day when a burst of traffic blows past the threshold, which daily rotation alone will not catch.

Note

If you run OpenClaw in Docker, logrotate never sees the file. The container writes to stdout and Docker's json-file driver logs to /var/lib/docker/containers. Cap it with log-opts (max-size, max-file) in /etc/docker/daemon.json instead.

Pruning sessions, transcripts, and media

Age-based cleanup beats size-based cleanup here, because deleting the wrong active session mid-conversation is worse than a full disk. Always dry-run first with -print, confirm the list looks like stale conversations, then swap in -delete.

find ~/.openclaw/sessions -name '*.jsonl' -mtime +30 -print
find ~/.openclaw/media -type f -mtime +14 -print

Put the confirmed versions in a weekly cron entry or systemd timer. If the agent handles anything you might need to audit later, archive to cold storage before deleting rather than removing outright.

Capping journald and container layers

Two more silent consumers on any long-lived agent host:

systemd journal. Set SystemMaxUse=200M in /etc/systemd/journald.conf, then run sudo journalctl --vacuum-size=200M to apply it retroactively.
Docker layers.docker system prune -af --filter "until=168h" clears dangling images and stopped containers older than a week. Container logs are separate, so handle those with the Docker note above.

Also worth checking: npm cache in ~/.npm and stale node_modules from abandoned plugin installs.

Catch growth before it becomes an outage

A full disk on an agent gateway is ugly. The process keeps running but silently fails to write session state, so conversations corrupt rather than erroring cleanly. Set a threshold alert at 80% usage, not 95%.

A simple cron check that mails or pings you when df crosses the line beats any dashboard. If you would rather not babysit the host yourself, run the gateway on a Hostinger VPS with NVMe storage and set the logrotate rule on day one. NVMe keeps transcript writes fast, but it does not add capacity, so the rotation config still does the real work.

Rotate the gateway log, prune transcripts by age, cap journald and Docker, and alert at 80%. That handles the four sources behind most OpenClaw disk-growth incidents.

Frequently asked questions

Why does OpenClaw use so much disk space?

The gateway log grows with every message, session transcripts store full conversation and tool-call history in JSONL, and the media cache keeps attachments. None of these are rotated by default, so a busy agent accumulates gigabytes over weeks.

Should I use copytruncate or restart the service in logrotate?

Use copytruncate if you do not want to interrupt the gateway — OpenClaw holds the log file descriptor open, and renaming the file without truncating means writes continue to the old inode. The alternative is a create directive plus a postrotate restart, which gives cleaner logs at the cost of a brief service blip.

How do I delete old OpenClaw sessions safely?

Filter by modification time with find -mtime, and always run the command with -print first to review the list. Delete only after confirming the files are stale conversations rather than an active session, and archive anything you may need to audit.

Does logrotate work when OpenClaw runs in Docker?

No. A containerized gateway writes to stdout, and Docker's json-file logging driver stores those lines under /var/lib/docker/containers. Cap them with max-size and max-file log options in the Docker daemon configuration instead of a logrotate rule.

Ready to get started? Check out Hostinger's plans.