Where are the system log files stored in SUSE?

English Applications
1

Hi,
New to SUSE and my fresh Tumbleweed install is having major issues. I’m hoping to find something useful in the system log files.
/var/logs doesn’t seem to have what I’m looking for. Help!

2

Hi, and welcome to openSUSE!
You can see all major logs in the system journal for the current boot via the command:

journalctl -b

You might not be able to see all system entries (or entries pertaining to other users) unless your username is added to the systemd-journal group, or you may use the superuser account to inspect the journal as in:

su -
<enter superuser (root) password>
journalctl -b

For other options see:

man journalctl

and feel free to ask again here.

Hope this helps.

3

Along the same line, what determines whether the journal persists across boots? TW20180618 that I just installed doesn’t have any system* or journal* in /var/log/.

4

Make sure that ‘Storage=persistent’ is set in /etc/systemd/journald.conf and that /var/log/journal exists.

More info…

[ul]
[li]11.1 Making the Journal Persistent[/li]

The journal stores log data in /run/log/journal/ by
default. Because the /run/ directory is volatile by
nature, log data is lost at reboot. To make the log data persistent, the
directory /var/log/journal/ with correct ownership and
permissions must exist, where the systemd-journald service can store its
data. systemd will create the directory for you—and switch to
persistent logging—if you do the following:

[LIST]

 As root, open /etc/systemd/journald.conf for

 editing.

[/ul]

vi /etc/systemd/journald.conf

[li] Uncomment the line containing Storage= and change it to [/li]> […]
[Journal]
Storage=persistent
#Compress=yes
[…]

[li] Save the file and restart systemd-journald: [/li]> systemctl restart systemd-journald
[/LIST]

https://doc.opensuse.org/documentation/leap/reference/html/book.opensuse.reference/cha.journalctl.html#sec.journalctl.persistent

5

@mrmazda
You have probably somehow chosen to use rsyslog instead of systemd-logger. Only one or the other can be installed.

6

Thanks for the tip. I’m now reading up on SystemD and its journaling.

Is there an out of the box way to access logs from previous boots? My system keeps freezing / becoming unresponsive and I want to see the entries prior to the problem.

EDIT: Thanks again! I see the persistence option. Missed those posts.

7

I have lots of openSUSE installations, only a few of which have /var/log/journal. My fresh TW didn’t until this thread. All my Fedoras do have /var/log/journal/, though IIRC none of them are impacted by logrotate, so I delete old ones as I encounter them.

8

Yes, none of them are impacted by logrotate, but there is a max limit on the space used by logs after which they are deleted. This limit is usually very large by default, see the SystemMaxUse= and related options in

man journald.conf

if you are not satisfied with the defaults.

9

@OP
You’ve been operating in “legacy” SysVinit mode…
Yes, in “the old days” syslog was written to /var/log/messages

But,
in systemd (nowadays) syslogs are written to a database, not text files.
This enables a number of features which didn’t exist when writing to text files including

  • Multiple sources write to the same database so you don’t have to aggregate or search for logs all over the place. They all write to, are stored in, and are searchable in one place.
  • Multiple source data in one place means that problems can be solved better by easily correlating data that couldn’t be done easily before.
  • The “journalctl” utility to search the systemd database is more powerful, enabling more precise and better search.
  • If you have a problem, you can “systemctl status servicename.service” to automatically view a likely relevant snippet of the syslog without searching.

If you still want to work with the old syslog text files, install the package “syslog-ng” which is an advanced version of the old syslog utility… copies of the journal syslog will be exported to text files in /var/log/

But, I’d highly recommend you invest some time in using the native systemd tools first…
Although I find the normal documentation like MAN pages extremely long and sometimes unnecessarily complex, there are a great many articles people have written on the Web that are simple, easy to understand and clear. A favorite is the following which is likely the top result in a Google search…

https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-systemd-logs

Good Luck,
TSU

10

Persistent logs should be enabled by default, no need to do anything yourself.

The Digital Ocean reference I provided in my previous post answers such things as searching previous boots…

So, for instance the following will display 2 boots ago (You may also want to reverse the entries so last appears first)

journalctl -b -2

Note another useful thing to do is to view your journal entries in real time…

journalctl -f

TSU

11

The default is “Storage=auto” AFAIK, and that means that persistent storage is saved only if /var/log/journal exists, since that directory is not created automatically if needed with the “auto” option.
Checking (or creating) that /var/log/journal is likely all that is needed (sorry cannot check for current Tumbleweed myself at the moment).

12

Yes, that is correct.

13

From
https://www.freedesktop.org/software/systemd/man/journald.conf.html

  1. It seems that “auto” which is default, is almost the same but not exactly as “persistent”

Storage=Controls where to store journal data. One of “volatile”, “persistent”, “auto” and “none”. If “volatile”, journal log data will be stored only in memory, i.e. below the /run/log/journal hierarchy (which is created if needed). If “persistent”, data will be stored preferably on disk, i.e. below the /var/log/journal hierarchy (which is created if needed), with a fallback to /run/log/journal (which is created if needed), during early boot and if the disk is not writable. “auto” is similar to “persistent” but the directory /var/log/journal is not created if needed, so that its existence controls where log data goes. “none” turns off all storage, all log data received will be dropped. Forwarding to other targets, such as the console, the kernel log buffer, or a syslog socket will still work however. Defaults to “auto”.

  1. The reference discusses forwarding to an external daemon in at least two places, which is likely what happens automatically when you install syslog-ng(It’s not just enough to export files, the files must be exported to a syslog daemon).

TSU

14

Title: Reference - openSUSE Leap 15.1

SourcePDF_Reference: book.opensuse.reference_color_en.pdf

Chapter: 11.1 Making the Journal Persistent

Page: 190

“auto” is similar to “persistent” but the auto will not create directory /var/log/journal

Do users then need to create /var/log/journal ?

As not clear different meaning of “persistent” being similar to “auto”

Am unsure IF setting “persistent” will create directory /var/log/journal
so used mkdir to create /var/log/journal

Be nice IF the manual can clarify.

15

Quoting from “man journald.conf”:

OPTIONS
All options are configured in the “[Journal]” section:

   Storage=
       Controls where to store journal data. One of "volatile", "persistent", "auto" and "none". If "volatile", journal log data will be stored only in memory, i.e. below the /run/log/journal hierarchy
       (which is created if needed). If "persistent", data will be stored preferably on disk, i.e. below the **/var/log/journal hierarchy (which is created if needed)**, with a fallback to /run/log/journal
       (which is created if needed), during early boot and if the disk is not writable.  **"auto" is similar to "persistent" but the directory /var/log/journal is not created if needed**, ...

Looks fairly clear to me…
But if you want a change you have to file a bug report against documentation, writing here has no effect. See Bugzilla Main Page