--- id: 2024-11-23-arch-linux-best-practices-and-maintenance-tips slug: arch-linux-best-practices-and-maintenance-tips title: "Arch Linux: Best Practices and Maintenance Tips" excerpt: "Guide for long-term Arch Linux maintenance: rolling-release hygiene, Arch News, .pacnew merging with pacdiff, orphan cleanup, systemd audits, and BTRFS snapshots." date: "2024-11-23T09:00:00+01:00" updated: "2026-08-27T23:30:00+02:00" author: name: "Sebastian Palencsar" handle: "spalencsar" category: "arch-linux-serie" tags: ["arch-linux", "best-practices", "pacman", "pacdiff", "systempflege", "systemd", "btrfs", "snapper", "linuxadmin"] toc: true reading_time: 40 --- After you have [successfully installed Arch Linux](/en/arch-linux-serie/archlinux-installation-and-basic-configuration){.badge-link-text} and equipped it with a working environment, the critical phase begins: long-term, stable operation. Arch Linux is a rolling-release system without rigid version cycles. This means software components are continuously updated to the latest upstream state — from the Linux kernel through system libraries to the desktop environment. A rolling-release system does not break through updates, but through lacking maintenance discipline: Anyone who blindly updates an Arch system, ignores changed upstream configurations (`.pacnew`), or accumulates orphaned packages risks boot problems and inconsistent software states. This guide is part of our [Arch Linux series](/en/category/arch-linux-serie){.badge-link-text} and summarizes proven best practices for professional system maintenance. We cover the complete maintenance cycle: from gathering information before updates, through configuration merging with `pacdiff`, automated cache and orphan cleanup, to snapshot rollback strategies with BTRFS and `snapper`.
💡 **Prerequisites:** A running Arch Linux system with sudo privileges. Basic understanding of package management with [Pacman](/en/arch-linux-serie/arch-linux-comprehensive-guide-package-manager-pacman){.badge-link-text} and service management via `systemd`.
## The Arch Linux Maintenance Cycle System maintenance under Arch Linux follows a clear, sequential routine: ```markdown ┌─────────────────────────────────────────────────────────────┐ │ THE ARCH LINUX MAINTENANCE CYCLE │ ├─────────────────────────────────────────────────────────────┤ │ 1. PREPARATION: Check Arch News & Breaking Changes │ │ 2. UPGRADE: Full system update (pacman -Syu) │ │ 3. MERGING: Reconcile .pacnew files (pacdiff) │ │ 4. HYGIENE: Remove orphans & clean cache (paccache) │ │ 5. AUDIT: Check failed services & logs │ └─────────────────────────────────────────────────────────────┘ ``` ## 1. The Professional Update Routine A system update under Arch Linux consists of more than simply running a terminal command. To avoid unforeseen incompatibilities, adherence to standardized steps is mandatory. ### Consult Arch News Before Every Update Major Arch upgrades (e.g., kernel migrations, `glibc`, Python major releases, or changes to configuration paths) occasionally require manual administrator intervention (*Manual Intervention*). These interventions are announced in advance by the Arch developers on the official website. **Best practices for news checking:** 1. **Check the website:** Before upgrading, check the homepage of [archlinux.org](https://archlinux.org/){.badge-link-text} or the RSS feed. 2. **Automated CLI check with `informant`:** The tool `informant` from the AUR forces reading of unconfirmed Arch News before every `pacman` call: ```bash # Install informant (via AUR helper or makepkg) yay -S informant # Read news interactively in the terminal and mark as read informant read ``` ### Full System Upgrades with `pacman -Syu` Perform upgrades exclusively as full system updates: ```bash sudo pacman -Syu ```
⚠️ **Partial upgrades are strictly forbidden:** The command `pacman -Sy ` downloads the latest package database and installs a single package with its current dependencies, while the rest of the system remains outdated. This inevitably leads to incompatible shared libraries (`.so` files) and destroys system integrity.
### Fast and Consistent Mirrors with `reflector` Outdated or desynchronized package mirrors deliver inconsistent package states. Generate a fresh mirror list weekly via HTTPS: ```bash # Install reflector sudo pacman -S reflector # Determine top 15 fastest and most current German HTTPS mirrors sudo reflector \ --country Germany \ --latest 15 \ --protocol https \ --sort rate \ --save /etc/pacman.d/mirrorlist ``` Enable the included systemd timer for automated weekly mirror list updates: ```bash sudo systemctl enable --now reflector.timer ``` ### LTS Kernel as Safety Net (*Fallback*) A kernel update can in rare cases cause hardware regressions (e.g., Wi-Fi drivers, proprietary graphics drivers). Always install the Long-Term Support kernel (`linux-lts`) as a fallback option alongside the mainline kernel: ```bash # Install LTS kernel and headers sudo pacman -S linux-lts linux-lts-headers ``` Update the bootloader configuration (example GRUB): ```bash sudo grub-mkconfig -o /boot/grub/grub.cfg ``` In the boot menu, a stable fallback kernel is now available at any time under *Advanced Options*. ## 2. Merging Configuration Files with `.pacnew` and `.pacsave` When a package update wants to update a configuration file you have previously modified locally, Pacman never blindly overwrites your changes. Instead, Pacman places a file with the `.pacnew` extension in the same directory.
❗ **Why `.pacnew` files are critical:** Anyone who ignores `.pacnew` files for months runs their system with outdated configuration structures. Changed syntaxes in `/etc/pam.d/system-auth`, `/etc/sudoers`, or `/etc/systemd/` cause services to refuse starting after updates or security mechanisms to become ineffective.
### Finding and Managing `.pacnew` Files with `pacdiff` The `pacman-contrib` package includes the interactive maintenance tool `pacdiff`: ```bash # Install pacman-contrib sudo pacman -S pacman-contrib ``` Start the check for all unmerged configuration files: ```bash # pacdiff with preferred diff tool (e.g., vimdiff, nvim -d, meld, or kdiff3) DIFFPROG=vimdiff sudo -E pacdiff ``` `pacdiff` searches the system for `.pacnew` and `.pacsave` files and offers interactive options for each match: ```text ==> pacnew file found for /etc/pacman.conf :: [V]iew (show diff), [M]erge (combine), [S]kip, [R]emove (delete), [O]verwrite, [Q]uit: ``` ### Best Practice for Merging 1. **[V]iew:** Check exactly which lines upstream has changed. 2. **[M]erge:** Transfer new upstream options into your production configuration while retaining your individual customizations (e.g., custom sudo defaults or Pacman options). 3. **[R]emove:** Only delete the `.pacnew` file once all relevant changes have been transferred to the original file. ## 3. System Hygiene & Package Database Cleanup Over time, orphaned dependencies, temporary build artifacts, and old package versions accumulate on every Linux system. ### Remove Orphaned Packages (*Orphans*) When you uninstall a program, its dependencies often remain on the hard drive as orphaned packages (*orphans*). List all orphaned packages: ```bash pacman -Qtdq ``` Remove all orphaned packages along with their unused dependencies and global configuration files: ```bash # Only run if pacman -Qtdq lists packages sudo pacman -Rns $(pacman -Qtdq) ```
💡 **Practical tip:** Define an alias in your `~/.bashrc` or `~/.zshrc`: `alias pacclean='sudo pacman -Rns $(pacman -Qtdq)'` This way you can clean up with a single command after major software uninstallations.
### Audit Foreign Packages and AUR Leftovers With `pacman -Qm` you list all packages that do not come from the official repositories (e.g., AUR packages or manually installed `.pkg.tar.zst` files): ```bash pacman -Qm ``` Review this list monthly: outdated or orphaned AUR packages that are no longer maintained upstream should be uninstalled or replaced by official repository alternatives. ### Verify Package Integrity Check whether installed files on the file system have been accidentally modified, corrupted, or deleted: ```bash # Checks file sizes and checksums of all installed packages sudo pacman -Qkk ``` ### Automated Cache Management with `paccache` Pacman by default retains all downloaded packages in `/var/cache/pacman/pkg/`. Without maintenance, this folder grows to tens of gigabytes. Use `paccache` from `pacman-contrib`: ```bash # Keep the last 2 versions of installed packages (for emergency rollbacks) sudo paccache -r -k 2 # Completely remove all cache files of already uninstalled packages sudo paccache -ruk0 ``` Enable weekly cleanup as a systemd timer: ```bash sudo systemctl enable --now paccache.timer ``` ## 4. systemd Maintenance, Log Management & Performance A stable Arch system requires regular checks of system services and log file storage consumption. ### Track Down Failed Services After every system boot and after major updates, check whether all systemd services are running cleanly: ```bash systemctl --failed ``` If a service is marked as `failed`, analyze the cause specifically in the journal: ```bash journalctl -u servicename.service -b -e ``` ### Limit and Clean Up Log Size The `systemd-journald` subsystem stores system logs persistently in `/var/log/journal/`. Limit storage consumption in `/etc/systemd/journald.conf`: ```ini [Journal] Storage=persistent SystemMaxUse=1G SystemKeepFree=2G ``` Manual cleanup of old logs: ```bash # Keep only logs from the last 14 days sudo journalctl --vacuum-time=2weeks # Or: Limit journal storage immediately to max 500 MB sudo journalctl --vacuum-size=500M ``` ### Analyze Boot Performance Check which services slow down the system boot: ```bash # Display total boot time systemd-analyze # List services sorted by startup time systemd-analyze blame # Visualize critical chain of dependencies at boot systemd-analyze critical-chain ``` ### Enable SSD Maintenance with TRIM On systems with SSDs or NVMe drives, the TRIM command ensures that freed storage blocks are efficiently reused by the controller: ```bash # Enable weekly fstrim timer sudo systemctl enable --now fstrim.timer ``` ## 5. Disaster Recovery & Rollback Strategies with BTRFS and Snapper Anyone running Arch Linux on a BTRFS file system can fully secure package updates: Before and after every `pacman` transaction, a file system snapshot is automatically created. If an update fails, you boot directly back into the previous snapshot. ### Set Up Snapper and Automated Pacman Snapshots Install the required tools: ```bash sudo pacman -S snapper snap-pac grub-btrfs ``` Create a Snapper configuration for the root file system: ```bash sudo snapper -c root create-config / ``` The `snap-pac` package automatically hooks in as a Pacman pre- and post-hook. With every `pacman -Syu`, a numbered snapshot is automatically created: ```bash # List all existing snapshots sudo snapper -c root list ``` Example output: ```text # | Type | Pre # | Date | User | Cleanup | Description | Userdata ---+--------+-------+--------------------------+------+---------+-------------------+--------- 0 | single | | | root | | current | 1 | pre | | Fri 27 Aug 2026 20:00:00 | root | number | pacman -Syu | 2 | post | 1 | Fri 27 Aug 2026 20:02:15 | root | number | pacman -Syu | ``` ### Snapshot Boot via GRUB (`grub-btrfs`) `grub-btrfs` automatically generates boot entries for all existing BTRFS snapshots in the GRUB menu. Enable the systemd service that automatically updates the menu when new snapshots are created: ```bash sudo systemctl enable --now grub-btrfsd.service ``` If an update leads to an unusable system, simply select the snapshot before the transaction at boot, boot into a working system, and perform a rollback: ```bash # Rollback to snapshot 1 sudo snapper --ambit classic rollback 1 sudo reboot ``` ## 6. Advanced Tips for Daily Use Small, targeted optimizations increase comfort and reliability in daily operation. ### Enable Early Microcode & Early KMS Microcode updates for Intel and AMD processors fix critical CPU security vulnerabilities (e.g., Spectre/Meltdown) and should be loaded as early as possible at boot: ```bash # Install depending on processor: sudo pacman -S intel-ucode # For Intel CPUs # or: sudo pacman -S amd-ucode # For AMD CPUs ``` GRUB automatically detects the microcode images when regenerating the configuration: ```bash sudo grub-mkconfig -o /boot/grub/grub.cfg ``` For flicker-free graphics initialization at boot, enable the corresponding kernel module in `/etc/mkinitcpio.conf` (Early KMS): ```ini # Example for Intel graphics: MODULES=(i915) # Example for AMD graphics: # MODULES=(amdgpu) ``` Regenerate initramfs: ```bash sudo mkinitcpio -P ``` ### `pkgfile`: Find Missing Commands and Files You know the name of a command but don't know which package it's in? `pkgfile` searches all repositories: ```bash sudo pacman -S pkgfile sudo pkgfile -u ``` Example: ```bash pkgfile dig # Output: extra/bind ``` ## Best Practice Maintenance Matrix | Interval | Task | Command / Tool | |----------|------|----------------| | **Before every update** | Check Arch News | [archlinux.org](https://archlinux.org/){.badge-link-text} / `informant` | | **Daily / Weekly** | Full system upgrade | `sudo pacman -Syu` | | **After every update** | Merge configuration files | `DIFFPROG=vimdiff sudo -E pacdiff` | | **Weekly** | Check failed services | `systemctl --failed` | | **Weekly** | Remove orphaned packages | `sudo pacman -Rns $(pacman -Qtdq)` | | **Automated** | Clean package cache | `paccache.timer` | | **Automated** | Optimize mirror list | `reflector.timer` | | **Automated** | Run SSD TRIM | `fstrim.timer` | | **Monthly** | Audit foreign packages / AUR | `pacman -Qm`, `arch-audit` | | **Monthly** | Check journal size | `journalctl --vacuum-time=2weeks` | ## Further Resources [Arch Linux: System Hardening and Security – Best Practices](/en/arch-linux-serie/arch-linux-system-hardening-security-best-practices){.badge-link-text} [Arch Linux: Advanced Security Features and Maintenance](/en/arch-linux-serie/arch-linux-advanced-security-features-and-maintenance){.badge-link-text} [Pacman: The Comprehensive Guide](/en/arch-linux-serie/arch-linux-comprehensive-guide-package-manager-pacman){.badge-link-text} [Arch Linux Installation and Basic Configuration](/en/arch-linux-serie/archlinux-installation-and-basic-configuration){.badge-link-text} [Official Arch Linux System Maintenance Guidelines (Arch Wiki)](https://wiki.archlinux.org/title/System_maintenance){.badge-link-text} ## Conclusion A rolling-release system like Arch Linux does not demand hours of maintenance, but a consistent, structured routine. By using systemd timers for background tasks like cache cleanup, mirror updates, and SSD TRIM, you reduce manual effort to a minimum. The combination of automatic BTRFS snapshots before every `pacman` call (`snap-pac`) and direct boot integration (`grub-btrfs`) removes the risk from upgrades: even if a faulty package prevents booting, you can roll back to a consistent pre-update state in seconds. Combined with regular `.pacnew` file processing via `pacdiff`, your configuration always stays clean and current.
💡 **Practical tip:** Never ignore `.pacnew` files for extended periods. When new syntax standards are introduced in upstream services, outdated configurations can lead to unexpected service failures. A quick `pacdiff` check after every major update is mandatory.
In the next article of our series, we take your system security to the next level: In [Arch Linux: System Hardening and Security – Best Practices](/en/arch-linux-serie/arch-linux-system-hardening-security-best-practices){.badge-link-text} we harden sudo and the PAM stack, restrict unauthorized process inspection with `hidepid`, configure a restrictive stateful firewall with `nftables`, and secure the SSH service against brute-force attacks.