For several years I have not been able to check my boot logs using the command:-
journalctl -b -1
Which gave me no result. This used to work but at some point didn’t and I have worked around relevant problems ever since until now when I really needed to understand what was happening at boot.
It appears I had no directory /var/log/journal on my system so have added it and now I can see see my boot logs but it is clear that my drive will quickly fill up unless pruned. It seems that the default setup for my system did not include either boot logging or pruning. Now I have obtained the boot info I wanted I seek help setting my system correctly so that I can easily access previous boot but not fill me drive. Please could I have some help with this?
Many thanks, a treasure trove I had not read before; excellent but a lot to take in in one quick view. I see now the initial problem and how pruning works. I have not yet been able to follow why I did not set up /var/log/journal when I first installed my system.
I had made the mistake of setting Storage to persistent but have now restored the auto setting and commented out the line as I was clearly wrong the first time.
I do think I may have made other mistakes so will send you the logs as you asked in another thread.
Meanwhile on my workstation in my office I checked and there is no default /var/log/journal either.
I have read the journald.conf again and I do not have a clue why my normal boot process does not include a default for having this set so that one can check the boot log.
Hi and thanks,
I have it all now and have created the /var/log/journal and all is well.
What I had not been aware of was that at some point in time the workstation version of the installation omitted this directory, possible a decision to reduce wear on SSDs. I believe the directory is included in server versions. In my ignorance I was not aware of the problem or how easy it was to change.
This is historical SLE default which Leap inherits. So far SLE defaulted to using rsyslog for persistent logging and left journal in (default) volatile mode only. In the past there was package that “switched” between syslog and journal (by creating /var/log/journal) but looks it was dropped.