What’s new in RHEL7: Persistent journal log

Systemd journal logs are by default not persistent. They are stored in memory (kernel ring buffer) are /run/log/journal. This means, journal logs are available only from the current boot.

# journalctl --list-boots
0 f27172ee431b4012af52b7623468e2fc Fri 2016-10-21 06:16:53 CDT—Fri 2016-10-21 06:17:22 CDT

Logs from previous boot are not available. However, since journal logs are forward to rsyslog are default, you can still see journal logs from previous boot from /var/log/messages. You will not be able to view logs from previous boots using the journalctl command.

Lets make journal logs persistent.

# mkdir /var/log/journal
# systemctl restart systemd-journald
# reboot

We now have journal from current boot and previous boot

# journalctl --list-boots
-1 f27172ee431b4012af52b7623468e2fc Fri 2016-10-21 06:16:53 CDT—Fri 2016-10-21 06:18:54 CDT
 0 9593dfaca170423ea44399e1210da9c8 Fri 2016-10-21 06:19:09 CDT—Fri 2016-10-21 06:19:44 CDT

View journal from current boot

journalctl -b 0

View journal from previous boot

journalctl -b -1

View journal from oldest boot

journalctl

To reverse the change we made, delete /var/log/journal

# rm -rf /var/log/journal/
# systemctl restart systemd-journald
# journalctl --list-boots
 0 9593dfaca170423ea44399e1210da9c8 Fri 2016-10-21 06:22:21 CDT—Fri 2016-10-21 06:22:21 CDT
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s