Page 1 of 2 12 LastLast
Results 1 to 10 of 15

Thread: Where are the system log files stored in SUSE?

  1. #1

    Question Where are the system log files stored in SUSE?

    Hi,
    New to SUSE and my fresh Tumbleweed install is having major issues. I'm hoping to find something useful in the system log files.
    /var/logs doesn't seem to have what I'm looking for. Help!

  2. #2
    Join Date
    Oct 2014
    Location
    Italy
    Posts
    1,667

    Default Re: Where are the system log files stored in SUSE?

    Hi, and welcome to openSUSE!
    You can see all major logs in the system journal for the current boot via the command:
    Code:
    journalctl -b
    You might not be able to see all system entries (or entries pertaining to other users) unless your username is added to the systemd-journal group, or you may use the superuser account to inspect the journal as in:
    Code:
    su -
    <enter superuser (root) password>
    journalctl -b
    For other options see:
    Code:
    man journalctl
    and feel free to ask again here.

    Hope this helps.
    Main: Leap 15 Gnome on i7 4720HQ + Geforce GTX960M
    Test: Leap 42.3 (& others) on Core2Duo + GM965

  3. #3
    Join Date
    Dec 2008
    Location
    FL, USA
    Posts
    1,490

    Default Re: Where are the system log files stored in SUSE?

    Along the same line, what determines whether the journal persists across boots? TW20180618 that I just installed doesn't have any system* or journal* in /var/log/.
    Reg. Linux User #211409 *** multibooting since 1992
    Primary: 42.3,TW,15.0 & 13.1 on Haswell w/ RAID
    Secondary: eComStation (OS/2)&42.3 on 965P/Radeon
    Tertiary: TW,15.0,42.3,Fedora,Debian,more on Kaby Lake,Q45,Q43,G41,G3X,965G,Cedar,Caicos,Oland,GT218&&&

  4. #4
    Join Date
    Jun 2008
    Location
    Auckland, NZ
    Posts
    20,016
    Blog Entries
    1

    Default Re: Where are the system log files stored in SUSE?

    Quote Originally Posted by mrmazda View Post
    Along the same line, what determines whether the journal persists across boots? TW20180618 that I just installed doesn't have any system* or journal* in /var/log/.
    Make sure that 'Storage=persistent' is set in /etc/systemd/journald.conf and that /var/log/journal exists.

    More info...
    • 11.1 Making the Journal Persistent



      The journal stores log data in /run/log/journal/ by
      default. Because the /run/ directory is volatile by
      nature, log data is lost at reboot. To make the log data persistent, the
      directory /var/log/journal/ with correct ownership and
      permissions must exist, where the systemd-journald service can store its
      data. systemd will create the directory for you—and switch to
      persistent logging—if you do the following:



      • As root, open /etc/systemd/journald.conf for
        editing.




    • vi /etc/systemd/journald.conf
    • Uncomment the line containing Storage= and change it to
      [...]
      [Journal]
      Storage=persistent
      #Compress=yes
      [...]
    • Save the file and restart systemd-journald:
      systemctl restart systemd-journald
    https://doc.opensuse.org/documentati...ctl.persistent
    openSUSE Leap 15.0; KDE Plasma 5

  5. #5
    Join Date
    Oct 2008
    Location
    Glasgow, Scotland
    Posts
    1,130

    Default Re: Where are the system log files stored in SUSE?

    @mrmazda
    You have probably somehow chosen to use rsyslog instead of systemd-logger. Only one or the other can be installed.
    ~Thank you for sharing an interesting problem.
    --
    slàinte mhath,
    rayH

  6. #6

    Default Re: Where are the system log files stored in SUSE?

    Thanks for the tip. I'm now reading up on SystemD and its journaling.

    Is there an out of the box way to access logs from previous boots? My system keeps freezing / becoming unresponsive and I want to see the entries prior to the problem.

    EDIT: Thanks again! I see the persistence option. Missed those posts.

  7. #7
    Join Date
    Dec 2008
    Location
    FL, USA
    Posts
    1,490

    Default Re: Where are the system log files stored in SUSE?

    I have lots of openSUSE installations, only a few of which have /var/log/journal. My fresh TW didn't until this thread. All my Fedoras do have /var/log/journal/, though IIRC none of them are impacted by logrotate, so I delete old ones as I encounter them.
    Reg. Linux User #211409 *** multibooting since 1992
    Primary: 42.3,TW,15.0 & 13.1 on Haswell w/ RAID
    Secondary: eComStation (OS/2)&42.3 on 965P/Radeon
    Tertiary: TW,15.0,42.3,Fedora,Debian,more on Kaby Lake,Q45,Q43,G41,G3X,965G,Cedar,Caicos,Oland,GT218&&&

  8. #8
    Join Date
    Oct 2014
    Location
    Italy
    Posts
    1,667

    Default Re: Where are the system log files stored in SUSE?

    Quote Originally Posted by mrmazda View Post
    I have lots of openSUSE installations, only a few of which have /var/log/journal. My fresh TW didn't until this thread. All my Fedoras do have /var/log/journal/, though IIRC none of them are impacted by logrotate, so I delete old ones as I encounter them.
    Yes, none of them are impacted by logrotate, but there is a max limit on the space used by logs after which they are deleted. This limit is usually very large by default, see the SystemMaxUse= and related options in
    Code:
    man journald.conf
    if you are not satisfied with the defaults.
    Main: Leap 15 Gnome on i7 4720HQ + Geforce GTX960M
    Test: Leap 42.3 (& others) on Core2Duo + GM965

  9. #9
    Join Date
    Jun 2008
    Location
    San Diego, Ca, USA
    Posts
    10,842
    Blog Entries
    2

    Default Re: Where are the system log files stored in SUSE?

    @OP
    You've been operating in "legacy" SysVinit mode...
    Yes, in "the old days" syslog was written to /var/log/messages

    But,
    in systemd (nowadays) syslogs are written to a database, not text files.
    This enables a number of features which didn't exist when writing to text files including
    - Multiple sources write to the same database so you don't have to aggregate or search for logs all over the place. They all write to, are stored in, and are searchable in one place.
    - Multiple source data in one place means that problems can be solved better by easily correlating data that couldn't be done easily before.
    - The "journalctl" utility to search the systemd database is more powerful, enabling more precise and better search.
    - If you have a problem, you can "systemctl status servicename.service" to automatically view a likely relevant snippet of the syslog without searching.

    If you still want to work with the old syslog text files, install the package "syslog-ng" which is an advanced version of the old syslog utility... copies of the journal syslog will be exported to text files in /var/log/

    But, I'd highly recommend you invest some time in using the native systemd tools first...
    Although I find the normal documentation like MAN pages extremely long and sometimes unnecessarily complex, there are a great many articles people have written on the Web that are simple, easy to understand and clear. A favorite is the following which is likely the top result in a Google search...

    https://www.digitalocean.com/communi...e-systemd-logs

    Good Luck,
    TSU
    Beginner Wiki Quickstart - https://en.opensuse.org/User:Tsu2/Quickstart_Wiki
    Solved a problem recently? Create a wiki page for future personal reference!
    Learn something new?
    Attended a computing event?
    Post and Share!

  10. #10
    Join Date
    Jun 2008
    Location
    San Diego, Ca, USA
    Posts
    10,842
    Blog Entries
    2

    Default Re: Where are the system log files stored in SUSE?

    Quote Originally Posted by jayarmstrong View Post
    Thanks for the tip. I'm now reading up on SystemD and its journaling.

    Is there an out of the box way to access logs from previous boots? My system keeps freezing / becoming unresponsive and I want to see the entries prior to the problem.

    EDIT: Thanks again! I see the persistence option. Missed those posts.
    Persistent logs should be enabled by default, no need to do anything yourself.

    The Digital Ocean reference I provided in my previous post answers such things as searching previous boots...

    So, for instance the following will display 2 boots ago (You may also want to reverse the entries so last appears first)
    Code:
    journalctl -b -2
    Note another useful thing to do is to view your journal entries in real time...
    Code:
    journalctl -f
    TSU
    Beginner Wiki Quickstart - https://en.opensuse.org/User:Tsu2/Quickstart_Wiki
    Solved a problem recently? Create a wiki page for future personal reference!
    Learn something new?
    Attended a computing event?
    Post and Share!

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •