Arch Linux: Best Practices and Maintenance Tips

After you have successfully installed Arch Linux and equipped it with a working environment, the critical phase begins: long-term, stable operation. Arch Linux is a rolling-release system without rigid version cycles. This means software components are continuously updated to the latest upstream state — from the Linux kernel through system libraries to the desktop environment.

A rolling-release system does not break through updates, but through lacking maintenance discipline: Anyone who blindly updates an Arch system, ignores changed upstream configurations (.pacnew), or accumulates orphaned packages risks boot problems and inconsistent software states.

This guide is part of our Arch Linux series and summarizes proven best practices for professional system maintenance. We cover the complete maintenance cycle: from gathering information before updates, through configuration merging with pacdiff, automated cache and orphan cleanup, to snapshot rollback strategies with BTRFS and snapper.

💡 Prerequisites: A running Arch Linux system with sudo privileges. Basic understanding of package management with Pacman and service management via systemd.

The Arch Linux Maintenance Cycle

System maintenance under Arch Linux follows a clear, sequential routine:

┌─────────────────────────────────────────────────────────────┐
│ THE ARCH LINUX MAINTENANCE CYCLE                            │
├─────────────────────────────────────────────────────────────┤
│ 1. PREPARATION: Check Arch News & Breaking Changes          │
│ 2. UPGRADE: Full system update (pacman -Syu)                │
│ 3. MERGING: Reconcile .pacnew files (pacdiff)               │
│ 4. HYGIENE: Remove orphans & clean cache (paccache)         │
│ 5. AUDIT: Check failed services & logs                      │
└─────────────────────────────────────────────────────────────┘

1. The Professional Update Routine

A system update under Arch Linux consists of more than simply running a terminal command. To avoid unforeseen incompatibilities, adherence to standardized steps is mandatory.

Consult Arch News Before Every Update

Major Arch upgrades (e.g., kernel migrations, glibc, Python major releases, or changes to configuration paths) occasionally require manual administrator intervention (Manual Intervention). These interventions are announced in advance by the Arch developers on the official website.

Best practices for news checking:

1. Check the website: Before upgrading, check the homepage of archlinux.org or the RSS feed.
2. Automated CLI check with informant: The tool informant from the AUR forces reading of unconfirmed Arch News before every pacman call:

# Install informant (via AUR helper or makepkg)
yay -S informant

# Read news interactively in the terminal and mark as read
informant read

Full System Upgrades with pacman -Syu

Perform upgrades exclusively as full system updates:

sudo pacman -Syu

⚠️ Partial upgrades are strictly forbidden: The command pacman -Sy <package> downloads the latest package database and installs a single package with its current dependencies, while the rest of the system remains outdated. This inevitably leads to incompatible shared libraries (.so files) and destroys system integrity.

Fast and Consistent Mirrors with reflector

Outdated or desynchronized package mirrors deliver inconsistent package states. Generate a fresh mirror list weekly via HTTPS:

# Install reflector
sudo pacman -S reflector

# Determine top 15 fastest and most current German HTTPS mirrors
sudo reflector \
  --country Germany \
  --latest 15 \
  --protocol https \
  --sort rate \
  --save /etc/pacman.d/mirrorlist

Enable the included systemd timer for automated weekly mirror list updates:

sudo systemctl enable --now reflector.timer

LTS Kernel as Safety Net (Fallback)

A kernel update can in rare cases cause hardware regressions (e.g., Wi-Fi drivers, proprietary graphics drivers). Always install the Long-Term Support kernel (linux-lts) as a fallback option alongside the mainline kernel:

# Install LTS kernel and headers
sudo pacman -S linux-lts linux-lts-headers

Update the bootloader configuration (example GRUB):

sudo grub-mkconfig -o /boot/grub/grub.cfg

In the boot menu, a stable fallback kernel is now available at any time under Advanced Options.

2. Merging Configuration Files with .pacnew and .pacsave

When a package update wants to update a configuration file you have previously modified locally, Pacman never blindly overwrites your changes. Instead, Pacman places a file with the .pacnew extension in the same directory.

❗ Why .pacnew files are critical: Anyone who ignores .pacnew files for months runs their system with outdated configuration structures. Changed syntaxes in /etc/pam.d/system-auth, /etc/sudoers, or /etc/systemd/ cause services to refuse starting after updates or security mechanisms to become ineffective.

Finding and Managing .pacnew Files with pacdiff

The pacman-contrib package includes the interactive maintenance tool pacdiff:

# Install pacman-contrib
sudo pacman -S pacman-contrib

Start the check for all unmerged configuration files:

# pacdiff with preferred diff tool (e.g., vimdiff, nvim -d, meld, or kdiff3)
DIFFPROG=vimdiff sudo -E pacdiff

pacdiff searches the system for .pacnew and .pacsave files and offers interactive options for each match:

==> pacnew file found for /etc/pacman.conf
:: [V]iew (show diff), [M]erge (combine), [S]kip, [R]emove (delete), [O]verwrite, [Q]uit:

Best Practice for Merging

1. [V]iew: Check exactly which lines upstream has changed.
2. [M]erge: Transfer new upstream options into your production configuration while retaining your individual customizations (e.g., custom sudo defaults or Pacman options).
3. [R]emove: Only delete the .pacnew file once all relevant changes have been transferred to the original file.

3. System Hygiene & Package Database Cleanup

Over time, orphaned dependencies, temporary build artifacts, and old package versions accumulate on every Linux system.

Remove Orphaned Packages (Orphans)

When you uninstall a program, its dependencies often remain on the hard drive as orphaned packages (orphans).

List all orphaned packages:

pacman -Qtdq

Remove all orphaned packages along with their unused dependencies and global configuration files:

# Only run if pacman -Qtdq lists packages
sudo pacman -Rns $(pacman -Qtdq)

💡 Practical tip: Define an alias in your ~/.bashrc or ~/.zshrc: alias pacclean='sudo pacman -Rns $(pacman -Qtdq)' This way you can clean up with a single command after major software uninstallations.

Audit Foreign Packages and AUR Leftovers

With pacman -Qm you list all packages that do not come from the official repositories (e.g., AUR packages or manually installed .pkg.tar.zst files):

pacman -Qm

Review this list monthly: outdated or orphaned AUR packages that are no longer maintained upstream should be uninstalled or replaced by official repository alternatives.

Verify Package Integrity

Check whether installed files on the file system have been accidentally modified, corrupted, or deleted:

# Checks file sizes and checksums of all installed packages
sudo pacman -Qkk

Automated Cache Management with paccache

Pacman by default retains all downloaded packages in /var/cache/pacman/pkg/. Without maintenance, this folder grows to tens of gigabytes.

Use paccache from pacman-contrib:

# Keep the last 2 versions of installed packages (for emergency rollbacks)
sudo paccache -r -k 2

# Completely remove all cache files of already uninstalled packages
sudo paccache -ruk0

Enable weekly cleanup as a systemd timer:

sudo systemctl enable --now paccache.timer

4. systemd Maintenance, Log Management & Performance

A stable Arch system requires regular checks of system services and log file storage consumption.

Track Down Failed Services

After every system boot and after major updates, check whether all systemd services are running cleanly:

systemctl --failed

If a service is marked as failed, analyze the cause specifically in the journal:

journalctl -u servicename.service -b -e

Limit and Clean Up Log Size

The systemd-journald subsystem stores system logs persistently in /var/log/journal/. Limit storage consumption in /etc/systemd/journald.conf:

[Journal]
Storage=persistent
SystemMaxUse=1G
SystemKeepFree=2G

Manual cleanup of old logs:

# Keep only logs from the last 14 days
sudo journalctl --vacuum-time=2weeks

# Or: Limit journal storage immediately to max 500 MB
sudo journalctl --vacuum-size=500M

Analyze Boot Performance

Check which services slow down the system boot:

# Display total boot time
systemd-analyze

# List services sorted by startup time
systemd-analyze blame

# Visualize critical chain of dependencies at boot
systemd-analyze critical-chain

Enable SSD Maintenance with TRIM

On systems with SSDs or NVMe drives, the TRIM command ensures that freed storage blocks are efficiently reused by the controller:

# Enable weekly fstrim timer
sudo systemctl enable --now fstrim.timer

5. Disaster Recovery & Rollback Strategies with BTRFS and Snapper

Anyone running Arch Linux on a BTRFS file system can fully secure package updates: Before and after every pacman transaction, a file system snapshot is automatically created. If an update fails, you boot directly back into the previous snapshot.

Set Up Snapper and Automated Pacman Snapshots

Install the required tools:

sudo pacman -S snapper snap-pac grub-btrfs

Create a Snapper configuration for the root file system:

sudo snapper -c root create-config /

The snap-pac package automatically hooks in as a Pacman pre- and post-hook. With every pacman -Syu, a numbered snapshot is automatically created:

# List all existing snapshots
sudo snapper -c root list

Example output:

 # | Type   | Pre # | Date                     | User | Cleanup | Description       | Userdata
---+--------+-------+--------------------------+------+---------+-------------------+---------
  0 | single |       |                          | root |         | current           |         
  1 | pre    |       | Fri 27 Aug 2026 20:00:00 | root | number  | pacman -Syu       |         
  2 | post   | 1     | Fri 27 Aug 2026 20:02:15 | root | number  | pacman -Syu       |         

Snapshot Boot via GRUB (grub-btrfs)

grub-btrfs automatically generates boot entries for all existing BTRFS snapshots in the GRUB menu.

Enable the systemd service that automatically updates the menu when new snapshots are created:

sudo systemctl enable --now grub-btrfsd.service

If an update leads to an unusable system, simply select the snapshot before the transaction at boot, boot into a working system, and perform a rollback:

# Rollback to snapshot 1
sudo snapper --ambit classic rollback 1
sudo reboot

6. Advanced Tips for Daily Use

Small, targeted optimizations increase comfort and reliability in daily operation.

Enable Early Microcode & Early KMS

Microcode updates for Intel and AMD processors fix critical CPU security vulnerabilities (e.g., Spectre/Meltdown) and should be loaded as early as possible at boot:

# Install depending on processor:
sudo pacman -S intel-ucode   # For Intel CPUs
# or:
sudo pacman -S amd-ucode     # For AMD CPUs

GRUB automatically detects the microcode images when regenerating the configuration:

sudo grub-mkconfig -o /boot/grub/grub.cfg

For flicker-free graphics initialization at boot, enable the corresponding kernel module in /etc/mkinitcpio.conf (Early KMS):

# Example for Intel graphics:
MODULES=(i915)

# Example for AMD graphics:
# MODULES=(amdgpu)

Regenerate initramfs:

sudo mkinitcpio -P

pkgfile: Find Missing Commands and Files

You know the name of a command but don't know which package it's in? pkgfile searches all repositories:

sudo pacman -S pkgfile
sudo pkgfile -u

Example:

pkgfile dig
# Output: extra/bind

Best Practice Maintenance Matrix

Further Resources

Arch Linux: System Hardening and Security – Best Practices Arch Linux: Advanced Security Features and Maintenance Pacman: The Comprehensive Guide Arch Linux Installation and Basic Configuration Official Arch Linux System Maintenance Guidelines (Arch Wiki)

Conclusion

A rolling-release system like Arch Linux does not demand hours of maintenance, but a consistent, structured routine. By using systemd timers for background tasks like cache cleanup, mirror updates, and SSD TRIM, you reduce manual effort to a minimum.

The combination of automatic BTRFS snapshots before every pacman call (snap-pac) and direct boot integration (grub-btrfs) removes the risk from upgrades: even if a faulty package prevents booting, you can roll back to a consistent pre-update state in seconds. Combined with regular .pacnew file processing via pacdiff, your configuration always stays clean and current.

💡 Practical tip: Never ignore .pacnew files for extended periods. When new syntax standards are introduced in upstream services, outdated configurations can lead to unexpected service failures. A quick pacdiff check after every major update is mandatory.

In the next article of our series, we take your system security to the next level: In Arch Linux: System Hardening and Security – Best Practices we harden sudo and the PAM stack, restrict unauthorized process inspection with hidepid, configure a restrictive stateful firewall with nftables, and secure the SSH service against brute-force attacks.