Where are the system log files stored in SUSE?

**jayarmstrong** · 21-Jun-2018, 00:12

Hi,
New to SUSE and my fresh Tumbleweed install is having major issues. I'm hoping to find something useful in the system log files.
/var/logs doesn't seem to have what I'm looking for. Help!

**OrsoBruno** · 21-Jun-2018, 01:40

Hi, and welcome to openSUSE!
You can see all major logs in the system journal for the current boot via the command:

Code:

journalctl -b

You might not be able to see all system entries (or entries pertaining to other users) unless your username is added to the systemd-journal group, or you may use the superuser account to inspect the journal as in:

Code:

su -
<enter superuser (root) password>
journalctl -b

For other options see:

Code:

man journalctl

and feel free to ask again here.

Hope this helps.

**mrmazda** · 21-Jun-2018, 14:55

Along the same line, what determines whether the journal persists across boots? TW20180618 that I just installed doesn't have any system* or journal* in /var/log/.

**deano_ferrari** · 21-Jun-2018, 15:51

Originally Posted by mrmazda

Along the same line, what determines whether the journal persists across boots? TW20180618 that I just installed doesn't have any system* or journal* in /var/log/.

Make sure that 'Storage=persistent' is set in /etc/systemd/journald.conf and that /var/log/journal exists.

More info...

11.1 Making the Journal Persistent

The journal stores log data in /run/log/journal/ by
default. Because the /run/ directory is volatile by
nature, log data is lost at reboot. To make the log data persistent, the
directory /var/log/journal/ with correct ownership and
permissions must exist, where the systemd-journald service can store its
data. systemd will create the directory for you—and switch to
persistent logging—if you do the following:
- As root, open /etc/systemd/journald.conf for
  editing.
vi /etc/systemd/journald.conf
Uncomment the line containing Storage= and change it to
[...]
[Journal]
Storage=persistent
#Compress=yes
[...]
Save the file and restart systemd-journald:
systemctl restart systemd-journald

https://doc.opensuse.org/documentati...ctl.persistent

**eng-int** · 21-Jun-2018, 15:56

@mrmazda
You have probably somehow chosen to use rsyslog instead of systemd-logger. Only one or the other can be installed.

**jayarmstrong** · 21-Jun-2018, 16:31

Thanks for the tip. I'm now reading up on SystemD and its journaling.

Is there an out of the box way to access logs from previous boots? My system keeps freezing / becoming unresponsive and I want to see the entries prior to the problem.

EDIT: Thanks again! I see the persistence option. Missed those posts.

**mrmazda** · 21-Jun-2018, 17:04

I have lots of openSUSE installations, only a few of which have /var/log/journal. My fresh TW didn't until this thread. All my Fedoras do have /var/log/journal/, though IIRC none of them are impacted by logrotate, so I delete old ones as I encounter them.

**OrsoBruno** · 22-Jun-2018, 01:05

Originally Posted by mrmazda

I have lots of openSUSE installations, only a few of which have /var/log/journal. My fresh TW didn't until this thread. All my Fedoras do have /var/log/journal/, though IIRC none of them are impacted by logrotate, so I delete old ones as I encounter them.

Yes, none of them are impacted by logrotate, but there is a max limit on the space used by logs after which they are deleted. This limit is usually very large by default, see the SystemMaxUse= and related options in

Code:

man journald.conf

if you are not satisfied with the defaults.

**tsu2** · 22-Jun-2018, 09:22

@OP
You've been operating in "legacy" SysVinit mode...
Yes, in "the old days" syslog was written to /var/log/messages

But,
in systemd (nowadays) syslogs are written to a database, not text files.
This enables a number of features which didn't exist when writing to text files including
- Multiple sources write to the same database so you don't have to aggregate or search for logs all over the place. They all write to, are stored in, and are searchable in one place.
- Multiple source data in one place means that problems can be solved better by easily correlating data that couldn't be done easily before.
- The "journalctl" utility to search the systemd database is more powerful, enabling more precise and better search.
- If you have a problem, you can "systemctl status servicename.service" to automatically view a likely relevant snippet of the syslog without searching.

If you still want to work with the old syslog text files, install the package "syslog-ng" which is an advanced version of the old syslog utility... copies of the journal syslog will be exported to text files in /var/log/

But, I'd highly recommend you invest some time in using the native systemd tools first...
Although I find the normal documentation like MAN pages extremely long and sometimes unnecessarily complex, there are a great many articles people have written on the Web that are simple, easy to understand and clear. A favorite is the following which is likely the top result in a Google search...

https://www.digitalocean.com/communi...e-systemd-logs

Good Luck,
TSU

**tsu2** · 22-Jun-2018, 09:27

Originally Posted by jayarmstrong

Thanks for the tip. I'm now reading up on SystemD and its journaling.

Is there an out of the box way to access logs from previous boots? My system keeps freezing / becoming unresponsive and I want to see the entries prior to the problem.

EDIT: Thanks again! I see the persistence option. Missed those posts.

Persistent logs should be enabled by default, no need to do anything yourself.

The Digital Ocean reference I provided in my previous post answers such things as searching previous boots...

So, for instance the following will display 2 boots ago (You may also want to reverse the entries so last appears first)

Code: