RHCSA - Operate Running Systems: Preserve System Journals

When log data preservation is enabled in systemd-journald, the logs are stored in the /var/log/journal/ directory. Each host has its own subdirectory within /var/log/journal/, identified by a unique machine ID.

If log data preservation is disabled or not configured, the logs are stored in the /run/log/journal/ directory. The /run directory is a temporary filesystem (tmpfs) that holds volatile data and does not persist across reboots.

Preservation of the journals is not active by default, so this guide will detail two methods to enable it.

Enabling Journal Preservation

The first method and simplest method for enabling journal preservation is by creating the /var/log/journal directory and flushing the journal. This works because the default storage option for the journal is Storage=auto. The auto setting means if the /var/log/journal directory exists, it will be used for preserving the journals.

The --flush option to the journalctl command asks the journal daemon to flush any log data stored in /run/log/journal/ into /var/log/journal/, if persistent storage is enabled.

Preserving the Journals, method one:

sudo mkdir -p /var/log/journal

sudo journalctl --flush

The second method involves updating the /etc/systemd/journald.conf file to set Storage=persistent. This setting will automatically create the /var/log/journal directory. After making the configuration change, the systemd-journald service needs restarting and the journal needs flushing.

Preserving the Journals, method two:

sudo sed -i 's/#Storage=auto/Storage=persistent/' /etc/systemd/journald.conf

sudo systemctl restart systemd-journald

sudo journalctl --flush

It is important to ensure the journals are preserved following a reboot to ensure setup was performed correctly.

Verify journals are preserved:

Confirm if logs are writing to /var/log/journal:

ls -l /var/log/journal/*

Reboot the server:

sudo reboot

Run journalctl and confirm the entries displayed are from before the reboot:

sudo journalctl

Support DTV Linux

Click on each book below to review & buy on Amazon. As an Amazon Associate, I earn from qualifying purchases.

NordVPN ®: Elevate your online privacy and security. Grab our Special Offer to safeguard your data on public Wi-Fi and secure your devices. I may earn a commission on purchases made through this link.