4

I recently got a problem with systemd not preserving logs from previous boots. I checked several answers here and elsewhere but haven't found a solution.

the problem is that the user log gets persistent across boots but system logs are not

/etc/systemd/journald.conf

[Journal]
Storage=persistent
SystemMaxUse=500M
SystemMaxFiles=5

journalctl -b -1

[root@2ba2de9e /var/log/journal] # journalctl --system -b -1
Data from the specified boot (-1) is not available: No such boot ID in journal

I'm using archlinux arm on some raspberry pis

versions 4.14.24-1-ARCH systemd 237.64-1 systemd-sysvcompat 237.64-1

Anyone has an idea why this is occurring? on my desktop machine this is working without problems?

Journeyman Geek
  • 6,977
  • 3
  • 32
  • 50
Jan Peter König
  • 73
  • 3

3 Answers3

2

It is possible that journald is removing the old logs because you're short on diskspace. (You didn't mention how long after boot the -b -1 is not working, so I don't know if you have many logs from the current boot at that time.)

You have SystemMaxUse=500M configured, but journald might decide to use less than 500MB if you don't have too much free diskspace. There is also a SystemKeepFree=... setting, which defaults to 15% of the size of the filesystem (or 4GB, whatever is smaller) and journald will enforce that limit more strongly than how much space you allow. If you have your /var/log/journal in a tight partition, maybe that might be part of the issue.

You can use some commands to check how much space journald is using, such as:

$ journalctl --disk-usage

And you and also see how many boots (and what are their times and IDs) journald knows about with:

$ journalctl --list-boots

These might also help shed a light on your issue...

I hope this helps!

filbranden
  • 652
  • 5
  • 9
1

My distro came with this file: /etc/systemd/journald.conf.d/volatile-storage.conf It had the following line

Storage=volatile

The volatile part needs to be changed to persistent, otherwise the change at /etc/systemd/journal.conf gets ignored.

mirr
  • 11
  • 1
0

Extending on mirr answer, for Storage=volatile and Storage=auto to work, the /var/log/journal directory must exist, and some distributions don't provide this location by default.

So you need to create and instruct journald to flush whatever is in memory to it.

sudo mkdir /var/log/journal     ## Enable persistent logging
sudo journalctl --flush
Fernando De Melo Braga
  • 1