Display systemd journal's archived logs
FedoraForum.org - Fedora Support Forums and Community
Results 1 to 11 of 11
  1. #1
    Join Date
    Feb 2010
    Location
    Costa de Caparica, Portugal
    Posts
    55
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Display systemd journal's archived logs

    I have systemd journal's archived logs that I need to view.
    How can I do it?

    This command is not worthwhile:
    Code:
    $ journalctl --since=yesterday
    It showed me today's logs.

  2. #2
    Join Date
    Oct 2004
    Posts
    107
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: Display systemd journal's archived logs

    If you want to display older messages in the _current_ journal, try:

    Code:
    journalctl --since -5d
    The above shows the last five days worth of logs. Use "-1w" for the one week ago. "-2h" for two hours ago. etc.

    The systemd time format is documented in:
    Code:
    man systemd.time
    Not an easy read since all time related stuff tends to be complex. But the time abbreviations should be obvious.

    The above assumes that you are using a recent Fedora version, since they have persistent journald storage enabled.

  3. #3
    Join Date
    Feb 2010
    Location
    Costa de Caparica, Portugal
    Posts
    55
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: Display systemd journal's archived logs

    Did not worked, I tried this:

    Code:
    journalctl --since -5d
    Code:
    journalctl --since -1w
    Now, shows today's and yesterday's log. Nothing else.

    I have more logs. I have not remove them. I think they are archived:

    Code:
    $ ls -l /var/log/*/
    
    system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001c5ba-000519acc5b3571d.journal
    system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001fa65-000519ad0ff00bd2.journal
    system.journal
    user-1000@ee13e6436422421da906549125cdc0fa-000000000001c5b9-000519acc5b355e5.journal
    user-1000.journal
    Last edited by pfedort; 30th June 2015 at 01:35 AM.

  4. #4
    Join Date
    Oct 2004
    Posts
    107
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: Display systemd journal's archived logs

    "systemctl" will automatically read and collate all files in the journal directory.

    So this sounds very much like a log corruption problem that makes it skip old dates. Since it collates all files, a single file may "block" things for the rest. Moving that file may "unblock" systemctl's ability to read the rest of the journals.

    This may find the problematic journal:
    Code:
    journalctl --verify
    Try to move the corrupted file to another directory, and then try to use "systemctl" again.

    Another option is to query specific files directly, using "--file".

    Code:
    journalctl --file /var/log/journal/MACHINE-ID*/<journal>
    Corrupted journals may still be queried by "systemctl" and may still contain most data. In this case it may only be some index or data fields that are corrupted.

    *machine-id is an unique number that is issued for your pc. You can find it by issuing a
    Code:
    hostnamectl

  5. #5
    Join Date
    Feb 2010
    Location
    Costa de Caparica, Portugal
    Posts
    55
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: Display systemd journal's archived logs

    Quote Originally Posted by Peter H.S.
    This may find the problematic journal:
    Code:
    journalctl --verify
    Code:
    journalctl --verify
    PASS: /var/log/journal/MACHINE-ID/system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001c5ba-000519acc5b3571d.journal                           
    PASS: /var/log/journal/MACHINE-ID/system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001fa65-000519ad0ff00bd2.journal                           
    PASS: /var/log/journal/MACHINE-ID/user-1000@ee13e6436422421da906549125cdc0fa-000000000001c5b9-000519acc5b355e5.journal                        
    PASS: /var/log/journal/MACHINE-ID/user-1000.journal                                                                                           
    PASS: /var/log/journal/MACHINE-ID/system.journal
    MACHINE-ID is the correct one.
    Everything is allright!


    Quote Originally Posted by Peter H.S.
    Another option is to query specific files directly, using "--file".

    Code:
    journalctl --file /var/log/journal/MACHINE-ID*/<journal>

    Systemd journal log files:

    Code:
    $ ls -1s /var/log/journal/*/
    total 57344
     8192 system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001c5ba-000519acc5b3571d.journal
     8192 system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001fa65-000519ad0ff00bd2.journal
     8192 system.journal
    16384 user-1000@ee13e6436422421da906549125cdc0fa-000000000001c5b9-000519acc5b355e5.journal
    16384 user-1000.journal
    Code:
    journalctl --file=system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001c5ba-000519acc5b3571d.journal
    -- Logs begin at Seg 2015-06-29 20:05:25 WEST, end at Seg 2015-06-29 20:25:40 WEST. --
    .......................................................................................
    .......................................................................................
    .......................................................................................
    
    $ journalctl --file=system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001fa65-000519ad0ff00bd2.journal
    -- Logs begin at Seg 2015-06-29 20:26:10 WEST, end at Seg 2015-06-29 23:02:30 WEST. --
    .......................................................................................
    .......................................................................................
    .......................................................................................
    
    $ journalctl --file=system.journal                                                                   
    -- Logs begin at Seg 2015-06-29 23:04:13 WEST, end at Qua 2015-07-01 23:05:39 WEST. --
    .......................................................................................
    .......................................................................................
    .......................................................................................
    
    $ journalctl --file=user-1000@ee13e6436422421da906549125cdc0fa-000000000001c5b9-000519acc5b355e5.journal
    -- Logs begin at Seg 2015-06-29 20:05:25 WEST, end at Seg 2015-06-29 20:25:51 WEST. --
    .......................................................................................
    .......................................................................................
    .......................................................................................
    
    $ journalctl --file=user-1000.journal                                                                   
    -- Logs begin at Seg 2015-06-29 23:03:16 WEST, end at Qua 2015-07-01 23:11:15 WEST. --
    .......................................................................................
    .......................................................................................
    .......................................................................................
    I think systemd journal logs since June 26 to June 29 are gone...

    Here is my journald.conf:

    Code:
    $ grep -v "#" /etc/systemd/journald.conf 
    
    Storage=persistent
    SystemMaxUse=50M
    SystemMaxFileSize=16M
    RuntimeMaxUse=32M
    RuntimeMaxFileSize=12M
    Another question: I set SystemMaxUse to 50M but actually systemd journal log occupy 57M(57344). Is it normal?
    Last edited by pfedort; 1st July 2015 at 11:36 PM.

  6. #6
    Join Date
    Oct 2004
    Posts
    107
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: Display systemd journal's archived logs

    Ok. This seems to simply be a matter of too small storage values in journald.conf. The older log files have simply been purged because you have chosen a size based log rotation scheme with very small values.

    On my Fedora 22 the journald.conf is empty, relying on the systemd default value of 10% of the file-system for log use. So I assume you inserted those values.

    If you want to keep logs for any reasonable length of time, you should really increase those values.

    Another thing is, that I find it strange that the UID1000 logs are larger than the system logs, and that you managed two system journal log rotates withing a day. You should check the journals to see if some service are spamming the log files.

  7. #7
    Join Date
    Feb 2010
    Location
    Costa de Caparica, Portugal
    Posts
    55
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: Display systemd journal's archived logs

    Quote Originally Posted by Peter H.S.
    Ok. This seems to simply be a matter of too small storage values in journald.conf. The older log files have simply been purged because you have chosen a size based log rotation scheme with very small values.
    Maybe, you're right...

    Quote Originally Posted by Peter H.S.
    On my Fedora 22 the journald.conf is empty, relying on the systemd default value of 10% of the file-system for log use. So I assume you inserted those values.
    You've assumed correctly.

    Quote Originally Posted by Peter H.S.
    If you want to keep logs for any reasonable length of time, you should really increase those values.
    Perhaps I will increase those values but not too much. I want to keep systemd journal log's files the smallest possible.

    Quote Originally Posted by Peter H.S.
    Another thing is, that I find it strange that the UID1000 logs are larger than the system logs, and that you managed two system journal log rotates withing a day. You should check the journals to see if some service are spamming the log files.
    I see the user's logs files are at the limit that I set: 16M. The system's logs files are at the limit of 8M which I did not set. Maybe the last one is the default value.

  8. #8
    Join Date
    Jun 2013
    Location
    USA
    Posts
    295
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: Display systemd journal's archived logs

    Why have small size log file? What is file space for except to store data?

    Robert

  9. #9
    Join Date
    Feb 2010
    Location
    Costa de Caparica, Portugal
    Posts
    55
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: Display systemd journal's archived logs

    Quote Originally Posted by rccharles
    Why have small size log file? What is file space for except to store data?

    Robert
    I'm using btrfs and I make snapshots regularly which occupies a lot of space.
    I rather use space in snapshots than on logs.

  10. #10
    Join Date
    Oct 2004
    Posts
    107
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: Display systemd journal's archived logs

    Quote Originally Posted by pfedort
    I'm using btrfs and I make snapshots regularly which occupies a lot of space.
    I rather use space in snapshots than on logs.
    Personally I would raise the log size considerably, since I find it useful so. But I am not you, and I don't know your setup.

    Here is my advice for running a system with small log file sizes:

    1. In "journald.conf" :
    Raise the "SystemMaxUse=" limit somewhat to 128M. Keep the SystemMaxFileSize=16M" since that will give you a 8-1 ratio between the two, which is a ratio journald defaults to otherwise. Perhaps combine with "MaxRetentionSec=1month" or whatever time-limit you find acceptable. That way the log files may never grow to the whole 128M, and you still have an acceptable amount of log info.

    Set "Compress=true"
    Set "SplitMode=none" This is because there will be some overhead in splitting your user logs into a separate log.


    2. Only store logs with syslog level "warning" and above in severity level. (MaxLevelStore=warning).

    When needing more logging-info for debugging a problem, just turn it on with:
    Code:
    systemd-analyze set-log-level debug
    and turn it off afterwards by:
    Code:
    systemd-analyze set-log-level warning
    Still set "SplitMode=none" and use compress.

  11. #11
    Join Date
    Feb 2010
    Location
    Costa de Caparica, Portugal
    Posts
    55
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: Display systemd journal's archived logs

    Quote Originally Posted by Peter H.S.
    Personally I would raise the log size considerably, since I find it useful so. But I am not you, and I don't know your setup.

    Here is my advice for running a system with small log file sizes:

    1. In "journald.conf" :
    Raise the "SystemMaxUse=" limit somewhat to 128M. Keep the SystemMaxFileSize=16M" since that will give you a 8-1 ratio between the two, which is a ratio journald defaults to otherwise. Perhaps combine with "MaxRetentionSec=1month" or whatever time-limit you find acceptable. That way the log files may never grow to the whole 128M, and you still have an acceptable amount of log info.

    Set "Compress=true"
    Set "SplitMode=none" This is because there will be some overhead in splitting your user logs into a separate log.
    For a starting, I decided to limit the logs only by date. However, day to day, I'm going to evaluate their growth.

    Quote Originally Posted by Peter H.S.
    2. Only store logs with syslog level "warning" and above in severity level. (MaxLevelStore=warning).

    When needing more logging-info for debugging a problem, just turn it on with:
    Code:
    systemd-analyze set-log-level debug
    and turn it off afterwards by:
    Code:
    systemd-analyze set-log-level warning
    I'm not going to follow this advice for now because I need info on the ssh connection that I set occasionally with my mother, to help her.

    Here is my current journald configuration:

    Code:
    $  grep -v "#" /etc/systemd/journald.conf 
    
    [Journal]
    Storage=persistent
    Compress=yes
    SplitMode=none
    MaxRetentionSec=3week
    I will be watching the logs to adjust its configuration if needed.

    Thanks for your help!

Similar Threads

  1. systemd-journal-flush.service always slow
    By upnort in forum Using Fedora
    Replies: 14
    Last Post: 5th October 2015, 02:23 AM
  2. A Journal Comes To systemd
    By tox in forum Linux Chat
    Replies: 0
    Last Post: 19th November 2011, 04:25 AM
  3. Simple display of systemd service sequence
    By charlweed in forum Using Fedora
    Replies: 2
    Last Post: 13th July 2011, 05:34 AM
  4. Display /etc/motd when user logs in?
    By lhouk in forum Using Fedora
    Replies: 1
    Last Post: 28th January 2009, 05:23 PM
  5. Vnc on display 0 logs me out when i close
    By sephiro499 in forum Using Fedora
    Replies: 1
    Last Post: 17th April 2007, 02:42 AM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •