1

From what I have learned, Centos 7 (by default) keeps log journal entries in memory only so these are lost when machine is rebooted. I'm comfortable with the fact that I can only see messages from current boot.

Putting syslog forwarding aside, how can I list all of the entries already stored in journal for the current boot? I tried:

[root@box ~]# journalctl -b 0
-- Logs begin at Wed 2015-12-02 16:32:14 CET, end at Wed 2015-12-02 18:09:55 CET. --

but it doesn't show old entries, only the entries for (as you can see) the past few hours.
My machine has actually been running for several days, though:

[root@box ~]# uptime
 18:12:38 up 19 days,  4:28,  1 user,  load average: 0.34, 0.39, 0.57

I'd like to see the logs for that whole period.

4

1 Answer 1

-1

I see the issue you are facing, on my hosts, I do not observe the same behavior. It shows correct information.For example see below

[root@centos7 ~]# uptime
 19:53:40 up 13 days,  6:10,  1 user,  load average: 0.06, 0.13, 0.20
[root@centos7 ~]# 
[root@centos7 ~]# journalctl -b |head -1
-- Logs begin at Sat 2015-11-21 13:42:51 EST, end at Fri 2015-12-04 19:48:26 EST. --

So, it must be something specific to your setup. Can you check, how big is the journal file? Is there any customization in your setup for journalctl like journal size restrictions? what is the output of journalctl --disk-usage ?

EDIT: You will see a line something similar to below on your host. Once the default limits are reached and if you do not have persistent storage, that log is gone and journalctl -b could only display whatever the oldest available log messages

Nov 21 13:43:27 xxxxxx-hostname systemd-journal[81]: Runtime journal is using 8.0M (max 74.8M, leaving 112.3M of free 740.6M, current limit 74.8M).
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .