Updates
Chapter 13 — Keeping Linux Healthy
A Linux system that is well maintained stays fast, stable, and secure for years. Neglect it — let updates pile up, disk space fill to the brim, logs balloon unchecked — and small problems compound into big ones. This final chapter covers the four pillars of desktop Linux maintenance: updates, disk space, logs, and backups.
1. Keeping the System Updated
Updates deliver security patches, bug fixes, and new features. On a Linux desktop you should run a full update at least once a week — more often if you're running a system exposed to the internet.
Full update routine — Ubuntu / Debian / Mint
# 1. Refresh the package index
$ sudo apt update
# 2. Upgrade all installed packages
$ sudo apt upgrade -y
# 3. Upgrade packages that need to remove or add others (new kernel versions etc.)
$ sudo apt full-upgrade -y
# 4. Remove packages that are no longer needed
$ sudo apt autoremove -y
# 5. Update Flatpak apps (if you use Flathub)
$ flatpak update -y
# Do it all in one line:
$ sudo apt update && sudo apt full-upgrade -y && sudo apt autoremove -y && flatpak update -y
Full update routine — Fedora
$ sudo dnf upgrade --refresh -y && flatpak update -y
apt upgrade vs apt full-upgrade.
apt upgrade only upgrades
packages that don't require removing or installing additional packages.
apt full-upgrade (formerly dist-upgrade) also handles packages
that need dependency changes — necessary for kernel updates. For daily use,
upgrade is fine. Run full-upgrade weekly to catch kernel
and library updates.
Checking for and applying kernel updates
# See which kernel you're currently running
$ uname -r
6.8.0-45-generic
# List installed kernels
$ dpkg --list | grep linux-image
linux-image-6.8.0-44-generic ... installed (old — can be removed)
linux-image-6.8.0-45-generic ... installed (current)
# A reboot is required after a kernel update
$ sudo reboot
Automatic security updates. Ubuntu ships with
unattended-upgrades pre-installed. It automatically applies security-only
updates in the background. You can check its configuration at
/etc/apt/apt.conf.d/50unattended-upgrades. It's a good safety net, but
it doesn't replace doing a full upgrade manually — it only handles security patches,
not all available updates.
Upgrading to a new distro version
Ubuntu releases a new LTS version every two years. When a new LTS is available, you'll see a notification in the Software Updater. You can also upgrade from the terminal:
# Upgrade Ubuntu to the next LTS version
$ sudo do-release-upgrade
# For Fedora (e.g., F39 → F40)
$ sudo dnf system-upgrade download --releasever=40
$ sudo dnf system-upgrade reboot
Always back up before a major version upgrade. Upgrading between distro
versions (Ubuntu 22.04 → 24.04, Fedora 39 → 40) is usually smooth, but it is a significant
operation that touches almost every package on the system. If something goes wrong, a backup
is the only reliable recovery path.
2. Managing Disk Space
A full disk is one of the most disruptive things that can happen to a Linux system — applications crash, logs stop writing, and in some cases the desktop itself freezes. Check disk usage regularly and clean up before you run out of space.
Checking disk usage
# Show disk usage for all mounted filesystems (-h = human-readable)
$ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda2 100G 42G 55G 44% /
/dev/sda1 512M 6.1M 506M 2% /boot/efi
tmpfs 3.9G 1.2M 3.9G 1% /tmp
# Show disk usage of a directory and all its subdirectories
$ du -sh ~/Downloads
14G /home/philip/Downloads
# Find the top 10 largest items in a directory
$ du -sh ~/* | sort -rh | head -10
# Find files larger than 500MB anywhere on the system
$ sudo find / -type f -size +500M 2>/dev/null
Here's what healthy vs warning disk usage looks like for your root partition (/):
Freeing up disk space
# Remove packages that are no longer needed as dependencies
$ sudo apt autoremove -y
# Clean the apt package cache (downloaded .deb files accumulate here)
$ sudo apt clean # Remove all cached packages
$ sudo apt autoclean # Remove only outdated cached packages
# See how much space the apt cache is using
$ du -sh /var/cache/apt/archives/
2.1G /var/cache/apt/archives/
# Remove old kernels (Ubuntu keeps the last two — autoremove handles this)
$ sudo apt autoremove --purge
# Remove Flatpak runtimes that are no longer used by any app
$ flatpak uninstall --unused -y
# Clear systemd journal logs older than 2 weeks (covered more in the next section)
$ sudo journalctl --vacuum-time=2weeks
# See the Trash and clear it
$ du -sh ~/.local/share/Trash/
$ rm -rf ~/.local/share/Trash/*
Don't delete files from /var, /usr, or /lib manually. These system
directories contain files managed by the package manager. Deleting individual files
here can break the system in ways that are hard to recover from. Use
apt remove, apt purge, and apt autoremove instead —
they cleanly handle all the dependencies.
GUI tools for disk space
- Disk Usage Analyzer (Baobab) —
sudo apt install baobab— treemap view of where your space is being used. Excellent for finding unexpected large files visually. - BleachBit —
sudo apt install bleachbit— cleans browser caches, temp files, and more. Run without root for user files, with root for system files. - ncdu —
sudo apt install ncdu— terminal-based interactive disk usage browser. Fast and works over SSH.
# ncdu — navigate with arrow keys, d to delete, q to quit
$ ncdu ~
3. Reading and Managing Log Files
Linux keeps detailed records of what the system and its services are doing. These logs
are invaluable when something goes wrong — they tell you exactly what happened and when.
Modern Linux uses systemd journal for most logging, supplemented by
traditional plain-text log files in /var/log/.
The systemd journal — journalctl
# Show all logs from the current boot
$ journalctl -b
# Follow new log entries in real time (like tail -f for the system)
$ journalctl -f
# Show logs for a specific service
$ journalctl -u NetworkManager
$ journalctl -u apache2
$ journalctl -u ssh
# Show only errors and critical messages
$ journalctl -p err -b
# Show logs since a specific time
$ journalctl --since "2024-06-15 09:00" --until "2024-06-15 10:00"
$ journalctl --since "1 hour ago"
# Show logs from the previous boot (useful after a crash)
$ journalctl -b -1
# Check how much disk space the journal is using
$ journalctl --disk-usage
Archived and active journals take up 512.0M in the file system.
# Trim journal logs older than 2 weeks / to a maximum size
$ sudo journalctl --vacuum-time=2weeks
$ sudo journalctl --vacuum-size=500M
Traditional log files in /var/log/
/var/log/syslog
General system messages. The first place to look when something is misbehaving. (Ubuntu/Debian)
/var/log/auth.log
All authentication events — logins, sudo commands, SSH attempts, failed passwords. Check this if you suspect unauthorised access.
/var/log/kern.log
Kernel messages. Useful for diagnosing hardware problems, driver errors, and filesystem issues.
/var/log/dpkg.log
Record of every package installed, upgraded, or removed by apt/dpkg. Useful for auditing what changed.
/var/log/apt/history.log
Higher-level apt command history — dates, packages, and whether the operation was manual or automatic.
/var/log/Xorg.0.log
X11 display server log. Check here for graphics driver problems, resolution issues, or display not starting.
/var/log/apache2/
Apache web server logs — access.log (every HTTP request) and error.log (problems). Present only if Apache is installed.
/var/log/dmesg
Kernel ring buffer from boot. Same as running
dmesg. Useful for hardware detection issues at startup.# Read a log file with less (arrow keys, q to quit, / to search)
$ sudo less /var/log/syslog
# Follow a log file in real time
$ sudo tail -f /var/log/syslog
# Search a log for a specific term
$ sudo grep "error" /var/log/syslog
$ sudo grep "Failed password" /var/log/auth.log
# See recent hardware messages (great for diagnosing USB / disk issues)
$ dmesg | tail -30
$ dmesg | grep -i "error\|fail\|usb"
Limiting journal size permanently
By default the journal has no hard size limit. To prevent it growing indefinitely,
edit /etc/systemd/journald.conf and add or uncomment these lines:
SystemMaxUse=500M
SystemKeepFree=200M
MaxRetentionSec=4week
# Apply the changes
$ sudo systemctl restart systemd-journald
4. Quick System Health Checks
A handful of commands give you a snapshot of how the system is doing right now:
# How long the system has been running, load averages, number of users
$ uptime
14:32:01 up 7 days, 3:12, 1 user, load average: 0.45, 0.38, 0.32
# CPU and memory usage — interactive, press q to quit
$ top
$ htop # Friendlier version: sudo apt install htop
# Memory usage summary
$ free -h
total used free shared buff/cache available
Mem: 7.7Gi 2.4Gi 3.1Gi 312Mi 2.2Gi 4.9Gi
Swap: 2.0Gi 0B 2.0Gi
# Check if any services have failed
$ systemctl --failed
UNIT LOAD ACTIVE SUB DESCRIPTION
● bluetooth.service loaded failed failed Bluetooth service
# See recent errors from the system journal
$ journalctl -p err -b --no-pager | tail -20
# Check disk health with SMART (requires smartmontools)
$ sudo apt install smartmontools
$ sudo smartctl -H /dev/sda
SMART overall-health self-assessment test result: PASSED
Load average explained. The three numbers after "load average:" in
uptime are the system load averaged over the last 1, 5, and 15 minutes.
A value of 1.0 on a single-core machine means 100% CPU use. On a 4-core machine, values
below 4.0 are fine. Values consistently above your core count mean the system is
overloaded and processes are queuing for CPU time.
5. Backup Strategies
Linux makes it easy to lose data — rm has no Recycle Bin, and a command
like sudo dd to the wrong device can wipe a disk instantly. A backup is
your safety net for both accidents and hardware failure. The golden rule is
3-2-1: three copies, on two different media types, with one copy offsite
(or in the cloud).
Easy
Déjà Dup (GUI)
sudo apt install deja-dup
Built-in to GNOME as "Backups". Backs up your home directory to a USB drive or cloud storage (Google Drive, Nextcloud). Scheduled automatic backups with encryption. Best option for beginners.
Easy
Timeshift (System snapshots)
sudo apt install timeshift
Snapshots the system (not personal files) using rsync or BTRFS snapshots. Like Windows System Restore — useful for rolling back after a bad update or config change. Pre-installed on Linux Mint.
Intermediate
rsync (command-line)
rsync -avh --delete ~/Documents /mnt/backup/
Powerful, flexible tool that synchronises files to another location. Only transfers changed files, making subsequent backups fast. Excellent for scripting and scheduling with cron. Available by default on most distros.
Intermediate
Restic (cloud + encryption)
sudo apt install restic
Modern backup tool with deduplication and encryption built in. Backs up to local disk, SSH server, S3, Backblaze B2, and more. Excellent for offsite cloud backups where you don't want the cloud provider to see your files.
A basic rsync backup script
# Back up ~/Documents to an external USB drive mounted at /mnt/backup
$ rsync -avh --delete ~/Documents/ /mnt/backup/Documents/
# Flags explained:
# -a archive mode (preserves permissions, timestamps, symlinks)
# -v verbose output (shows files being transferred)
# -h human-readable sizes
# --delete removes files from destination that no longer exist in source
# Dry run first — shows what WOULD be done without doing it
$ rsync -avhn --delete ~/Documents/ /mnt/backup/Documents/
Scheduling backups with cron
cron is the Linux task scheduler — it runs commands at set times
without you having to do anything. Edit your cron schedule with crontab -e:
# Open your personal crontab for editing
$ crontab -e
Cron uses a five-field time format: minute hour day month weekday
| Cron entry | What it does |
|---|---|
| 0 2 * * * /path/to/backup.sh | Run backup script every day at 2:00 AM |
| 0 3 * * 0 rsync -avh ~/Documents/ /mnt/usb/ | rsync every Sunday at 3:00 AM |
| */30 * * * * /usr/bin/my-check.sh | Run a script every 30 minutes |
| 0 9 1 * * /usr/bin/monthly-report.sh | Run on the 1st of every month at 9:00 AM |
| @reboot /home/philip/startup.sh | Run once at every system startup |
Crontab quick tip. Use
crontab -l to list your current
scheduled jobs without editing. If you're not sure your cron syntax is correct, the
website crontab.guru lets you type a cron expression and see in plain
English exactly when it will run.
What to back up
- Always:
~/— your home directory contains all personal files, browser profiles, application config (~/.config,~/.local), SSH keys (~/.ssh), and shell history (~/.bashrc) - If you have a server:
/etc/(all configuration files),/var/www/(web content), database dumps (usemysqldumpfor MySQL) - Less critical:
/usr/local/(manually installed software) — most of this can be reinstalled - Not worth backing up:
/tmp,/proc,/sys,/dev— these are virtual or temporary and should not be included in backups
6. Monthly Maintenance Checklist
- Run a full system update —
sudo apt update && sudo apt full-upgrade -y && sudo apt autoremove -y && flatpak update -y - Check disk space —
df -h. If root is above 80%, investigate withncdu ~andsudo apt clean - Verify backups ran — check Déjà Dup history, or
ls -lh /mnt/backup/if using rsync manually. Test that you can restore a file - Review failed services —
systemctl --failed. Investigate and restart or remove anything that shouldn't be failing - Check for errors in logs —
journalctl -p err -b --no-pager | head -30 - Clean the journal —
sudo journalctl --vacuum-time=4weeksif you haven't set a permanent limit - Reboot — especially after kernel updates. Clears memory, applies the new kernel, and reveals any boot issues in a controlled moment rather than unexpectedly
- Check Timeshift snapshots (if using) — ensure a recent snapshot exists before any major update or change
- Review UFW rules —
sudo ufw status verbose. Remove rules for services you no longer run - Check for suspicious login attempts —
sudo grep "Failed password" /var/log/auth.log | tail -20
Chapter Summary
| Topic | Key commands and tools |
|---|---|
| System updates | sudo apt update && sudo apt full-upgrade -y && sudo apt autoremove -y weekly. flatpak update -y for Flatpak apps. Reboot after kernel updates. |
| Disk space | df -h — overview. du -sh ~/path/ — size of a directory. ncdu ~ — interactive browser. sudo apt clean && sudo apt autoremove — reclaim space from package cache and old dependencies. |
| Logs | journalctl -b (this boot), journalctl -f (live tail), journalctl -u service (one service), journalctl -p err (errors only). Traditional files in /var/log/. Vacuum with --vacuum-time. |
| Health checks | uptime (load average), free -h (memory), systemctl --failed (broken services), htop (interactive CPU/memory). smartctl -H /dev/sda for disk health. |
| Backups | Déjà Dup (GUI, home directory). Timeshift (system snapshots, rollback). rsync -avh --delete src/ dest/ (scriptable, fast). Restic (encrypted, offsite cloud). Schedule with crontab -e. |