journalctl doesn't show recent journal entries

manleyd · 2014-10-10 11:16:23

If I call journalctl without any parameters, or with a --since parameter, it only shows entries up to 8th October (it's 10th October as I write this):

root~> journalctl --since '2014-10-01 00:00:00'
-- Logs begin at Thu 2014-08-28 11:19:31 BST, end at Fri 2014-10-10 12:01:01 BST. --
...
...
...
Oct 08 15:17:33 inspiron systemd[1]: Stopping Disk Manager...
Oct 08 15:17:33 inspiron systemd[1]: Stopping Daemon for power management...
Oct 08 15:17:33 inspiron systemd[1]: Stopping User Manager for UID 1000...
Oct 08 15:17:33 inspiron systemd[1]: Stopping WPA supplicant...
Oct 08 15:17:33 inspiron systemd[1]: Stopping Authorization Manager...
Oct 08 15:17:33 inspiron systemd[1]: Stopping Manage, Install and Generate Color Profiles...
Oct 08 15:17:33 inspiron systemd[1]: Stopping CUPS Printing Service...
Oct 08 15:17:33 inspiron systemd[1]: Stopping Graphical Interface.
Oct 08 15:17:33 inspiron systemd[1]: Stopped target Graphical Interface.
Oct 08 15:17:33 inspiron systemd[1]: Stopping Multi-User System.
root~>

If I call it with the -n parameter it shows all recent entries:

root~> journalctl -n 10
-- Logs begin at Thu 2014-08-28 11:19:31 BST, end at Fri 2014-10-10 12:01:01 BST. --
Oct 10 11:38:56 inspiron dbus[220]: [system] Successfully activated service 'org.kde.powerdevil.backlighthelper'
Oct 10 11:40:11 inspiron dbus[220]: [system] Activating service name='org.kde.powerdevil.backlighthelper' (using servicehelper)
Oct 10 11:40:11 inspiron org.kde.powerdevil.backlighthelper[1188]: QDBusConnection: system D-Bus connection created before QCoreAppli
Oct 10 11:40:11 inspiron dbus[220]: [system] Successfully activated service 'org.kde.powerdevil.backlighthelper'
Oct 10 11:41:17 inspiron dbus[220]: [system] Activating service name='org.kde.powerdevil.backlighthelper' (using servicehelper)
Oct 10 11:41:17 inspiron org.kde.powerdevil.backlighthelper[1192]: QDBusConnection: system D-Bus connection created before QCoreAppli
Oct 10 11:41:17 inspiron dbus[220]: [system] Successfully activated service 'org.kde.powerdevil.backlighthelper'
Oct 10 12:01:01 inspiron crond[1345]: pam_unix(crond:session): session opened for user root by (uid=0)
Oct 10 12:01:01 inspiron CROND[1346]: (root) CMD (run-parts /etc/cron.hourly)
Oct 10 12:01:01 inspiron CROND[1345]: pam_unix(crond:session): session closed for user root
root~>

I've tried reinstalling systemd but it made no difference. Do I need to reset the logs somehow?

mauritiusdadd · 2014-10-10 16:45:16

If you had read the manual page, you would know that this is the default behavior. In the very first lines it says:

"If called without parameters, it will show the full contents of the journal, starting with the oldest entry collected."

If you want the messages of the last boot, just use

journalctl -b -0

manleyd · 2014-10-10 16:54:47

mauritiusdadd

Read my post again. The point is that, without parameters, it isn't showing the full contents of the journal.

ewaller · 2014-10-10 17:27:24

What does journalctl --verify have to say?

Spider.007 · 2014-10-10 17:38:22

Also, have a look at the output of timedatectl; maybe your current time is incorrect?

mauritiusdadd · 2014-10-10 17:53:02

Ok, forgive me manleyd, I have misunderstood your question.
You should verify the integrity of your journal as suggested by ewaller.

jasonwryan · 2014-10-10 18:32:43

journalctl --list-boots

will also show you what has been logged.

Is this a laptop or a desktop? What are your settings in the conf file? Have you hit your limit: pass `--disk-usage`to check. Is logrotate running and when is it set to run?

manleyd · 2014-10-10 22:01:39

Thanks for the suggestions.

The time is correct.

journalctl --list-boots shows all the boots, including those after 'Oct 08 15:17:33'

Here is journalctl --verify:

PASS: /var/log/journal/ded9607d88904d69b94dda8437c92947/system@c081ad0077294ecda7c0a142ad64a58d-0000000000000001-000501addf58f184.journal
PASS: /var/log/journal/ded9607d88904d69b94dda8437c92947/system@000504e9f191a901-9b4b2795fabdaa41.journal~
PASS: /var/log/journal/ded9607d88904d69b94dda8437c92947/user-1000@000504e9f29d821e-a44f29e24c8fd814.journal~
000000: invalid tail monotonic timestamp                                                                
File corruption detected at /var/log/journal/ded9607d88904d69b94dda8437c92947/user-1000@89b22ce3586f47339e77fc56e24cbecc-00000000000004cc-000501ae1ff781f9.journal:000000 (of 8388608 bytes, 0%).
FAIL: /var/log/journal/ded9607d88904d69b94dda8437c92947/user-1000@89b22ce3586f47339e77fc56e24cbecc-00000000000004cc-000501ae1ff781f9.journal (Bad message)
PASS: /var/log/journal/ded9607d88904d69b94dda8437c92947/user-1000.journal                               
560f70: invalid entry item (5/23 offset: 000000                                                         
560f70: invalid object contents: Bad message                                                            
File corruption detected at /var/log/journal/ded9607d88904d69b94dda8437c92947/system@000504ea00013d02-f9141571b742d519.journal~:560f70 (of 8388608 bytes, 67%).
FAIL: /var/log/journal/ded9607d88904d69b94dda8437c92947/system@000504ea00013d02-f9141571b742d519.journal~ (Bad message)
PASS: /var/log/journal/ded9607d88904d69b94dda8437c92947/system.journal                                  
PASS: /var/log/journal/ded9607d88904d69b94dda8437c92947/system@c081ad0077294ecda7c0a142ad64a58d-0000000000003ef9-0005047f0ea56fd3.journal
39bff8: invalid object                                                                                  
File corruption detected at /var/log/journal/ded9607d88904d69b94dda8437c92947/user-1000@000504ea0184e373-450e16161e7cde68.journal~:39bff8 (of 8388608 bytes, 45%).
FAIL: /var/log/journal/ded9607d88904d69b94dda8437c92947/user-1000@000504ea0184e373-450e16161e7cde68.journal~ (Bad message)

Clearly log file(s) have been corrupted somehow. Is there a tool to clean the log files? It's a private laptop so it's not a big issue if I have to delete the logs and start again.

ewaller · 2014-10-11 06:17:20

As far as I know, there is not yet a tool like fsck to repair systemd logs. This is the one thing about systemd I don't like -- the binary logs that are subject to corruption.
It is okay to delete them. Just delete the ones that are damaged.

Arch Linux

#1 2014-10-10 11:16:23

journalctl doesn't show recent journal entries

#2 2014-10-10 16:45:16

Re: journalctl doesn't show recent journal entries

#3 2014-10-10 16:54:47

Re: journalctl doesn't show recent journal entries

#4 2014-10-10 17:27:24

Re: journalctl doesn't show recent journal entries

#5 2014-10-10 17:38:22

Re: journalctl doesn't show recent journal entries

#6 2014-10-10 17:53:02

Re: journalctl doesn't show recent journal entries

#7 2014-10-10 18:32:43

Re: journalctl doesn't show recent journal entries

#8 2014-10-10 22:01:39

Re: journalctl doesn't show recent journal entries

#9 2014-10-11 06:17:20

Re: journalctl doesn't show recent journal entries

Board footer