[SOLVED] journalctl last log is three months old

plsdont · 2022-01-15 21:28:18

My last entry in journalctl is from november last year.

When I do ls -ltr /var/log/journal/2bd1846d9a164c1ab739e131f463dad9/ it looks good.

-rw-r-----+ 1 root systemd-journal  16777216 Sep 14 01:06 system@0005cbe88232139e-1ff023218c44abf9.journal~
-rw-r-----+ 1 root systemd-journal   8388608 Sep 28 22:34 user-1000@46b0515cabda479c840caabc10762dfe-0000000000002b30-0005caaf909a5023.journal
-rw-r-----+ 1 root systemd-journal  16777216 Sep 28 22:34 system@4c4523b0035945ee9938c5f90ee04d97-0000000000000001-0005cbe8823162ec.journal
-rw-r-----+ 1 root systemd-journal   8388608 Oct 29 10:37 user-1000@46b0515cabda479c840caabc10762dfe-0000000000008103-0005cd1424a74e76.journal
-rw-r-----+ 1 root systemd-journal  16777216 Oct 29 10:37 system@4c4523b0035945ee9938c5f90ee04d97-0000000000008104-0005cd1493ea83d2.journal
-rw-r-----+ 1 root systemd-journal   8388608 Nov 13 00:53 user-1000@0005d0a02ad2e754-4bb0985c2235999c.journal~
-rw-r-----+ 1 root systemd-journal  16777216 Nov 28 23:23 system@4c4523b0035945ee9938c5f90ee04d97-000000000000bd81-0005cf7b3ba20f07.journal
-rw-r-----+ 1 root systemd-journal   8388608 Nov 28 23:23 user-1000@4cff02f0f14b425c908616b9c9f05fad-000000000000dd29-0005d0a02ad2d495.journal
-rw-r-----+ 1 root systemd-journal   8388608 Dec  4 13:00 system@0005d250c6998f9c-2626cc19701ae9b9.journal~
-rw-r-----+ 1 root systemd-journal   8388608 Dec  4 13:04 user-1000@0005d250d4aefd86-cf00839b893a8da7.journal~
-rw-r-----+ 1 root systemd-journal   8388608 Dec  7 00:30 system@0005d282a5c1d6a9-940be6123a6a802a.journal~
-rw-r-----+ 1 root systemd-journal   8388608 Dec 19 22:25 system@0005d3866a9f71a6-51da5a435dd161b9.journal~
-rw-r-----+ 1 root systemd-journal   8388608 Dec 23 11:19 system@0005d3cd92c63548-226206f2df7134d3.journal~
-rw-r-----+ 1 root systemd-journal   8388608 Dec 23 11:19 user-1000@0005d3cd936d47b3-ce7b597d8b3302fa.journal~
-rw-r-----+ 1 root systemd-journal  16777216 Jan  6 22:24 system@0005d4f080a3ca18-11dbb198a9b16a3b.journal~
-rw-r-----+ 1 root systemd-journal   8388608 Jan  8 17:43 system@0005d514cc03a414-a11aca7fb2c54143.journal~
-rw-r-----+ 1 root systemd-journal  16777216 Jan 15 21:56 user-1000.journal
-rw-r-----+ 1 root systemd-journal  33554432 Jan 15 21:56 system.journal

Service status says "Processing Request" also after restarting the service.

$ sudo systemctl status systemd-journald
● systemd-journald.service - Journal Service
     Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static)
     Active: active (running) since Sat 2022-01-15 22:26:15 CET; 3s ago
TriggeredBy: ● systemd-journald-dev-log.socket
             ● systemd-journald-audit.socket
             ● systemd-journald.socket
       Docs: man:systemd-journald.service(8)
             man:journald.conf(5)
   Main PID: 48154 (systemd-journal)
     Status: "Processing requests..."
      Tasks: 1 (limit: 9450)
     Memory: 1.1M
        CPU: 18ms
     CGroup: /system.slice/systemd-journald.service
             └─48154 /usr/lib/systemd/systemd-journald

Jan 15 22:26:15 m92 systemd-journald[48154]: Journal started
Jan 15 22:26:15 m92 systemd-journald[48154]: System Journal (/var/log/journal/2bd1846d9a164c1ab739e131f463dad9) is 1.3G, max 4.0G, 2.6G free.

Last edited by plsdont (2022-01-18 00:51:21)

ewaller · 2022-01-15 22:46:46

Please post your /etc/systemd/journald.conf file contents.

seth · 2022-01-16 08:41:12

My last entry in journalctl is from november last year.

What did you actually look at?

type journalctl # filtering alias?
journalctl --since yesterday # session
sudo journalctl --since yesterday # system

plsdont · 2022-01-18 00:50:39

/etc/systemd/journald.conf

#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it under the
#  terms of the GNU Lesser General Public License as published by the Free
#  Software Foundation; either version 2.1 of the License, or (at your option)
#  any later version.
#
# Entries in this file show the compile time defaults. Local configuration
# should be created by either modifying this file, or by creating "drop-ins" in
# the journald.conf.d/ subdirectory. The latter is generally recommended.
# Defaults can be restored by simply deleting this file and all drop-ins.
#
# Use 'systemd-analyze cat-config systemd/journald.conf' to display the full config.
#
# See journald.conf(5) for details.

[Journal]
#Storage=auto
#Compress=yes
#Seal=yes
#SplitMode=uid
#SyncIntervalSec=5m
#RateLimitIntervalSec=30s
#RateLimitBurst=10000
#SystemMaxUse=
#SystemKeepFree=
#SystemMaxFileSize=
#SystemMaxFiles=100
#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=
#RuntimeMaxFiles=100
#MaxRetentionSec=
#MaxFileSec=1month
#ForwardToSyslog=no
#ForwardToKMsg=no
#ForwardToConsole=no
#ForwardToWall=yes
#TTYPath=/dev/console
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#MaxLevelWall=emerg
#LineMax=48K
#ReadKMsg=yes
#Audit=yes

What did you actually look at?
type journalctl # filtering alias?
journalctl --since yesterday # session
sudo journalctl --since yesterday # system

$ type journalctl
journalctl is /usr/bin/journalctl

Oh damn Im sorry, I always did sudo journalctl and then CTRL+G to jump to the end. Now --since yesterday revealed recent logs. Sorry.

ewaller · 2022-01-18 02:35:16

You might shut down and reboot to ensure the logs are persistent.

You also way wish to see if there is corruption in your logs with journalctl --verify

In general, I've no issue with systemd and have come to like it. But, I really don't like the journal, how it is stored, and that by default it collects core dumps. But, I digress.

Arch Linux

#1 2022-01-15 21:28:18

[SOLVED] journalctl last log is three months old

#2 2022-01-15 22:46:46

Re: [SOLVED] journalctl last log is three months old

#3 2022-01-16 08:41:12

Re: [SOLVED] journalctl last log is three months old

#4 2022-01-18 00:50:39

Re: [SOLVED] journalctl last log is three months old

#5 2022-01-18 02:35:16

Re: [SOLVED] journalctl last log is three months old

Board footer