Reading the content of man journalctl, I came across the following:

       Controls where to store journal data. One of "volatile", "persistent", "auto" and "none". If "volatile", journal log data will be stored only in memory, i.e. below the
       /run/log/journal hierarchy (which is created if needed). If "persistent", data will be stored preferably on disk, i.e. below the /var/log/journal hierarchy (which is created
       if needed), with a fallback to /run/log/journal (which is created if needed), during early boot and if the disk is not writable.  "auto" is similar to "persistent" but the
       directory /var/log/journal is not created if needed, so that its existence controls where log data goes.  "none" turns off all storage, all log data received will be dropped.
       Forwarding to other targets, such as the console, the kernel log buffer, or a syslog socket will still work however. Defaults to "auto".

however when trying to less a file there, I get:

[root@long-misc-p001 logs]# less /run/log/journal/xxxxxx/system.journal
"/run/log/journal/xxxxxx/system.journal" may be a binary file.  See it anyway?

I haven't set that option to persistent yet, but if I then proceed to less it, I get a binary - is this expected? journactl usually gives me text.

  • 5
    Journal files are binary files. journalctl is a tool that reads the binary format and presents you with text records. Everything seems to be working as expected.
    – larsks
    Mar 27, 2017 at 13:24

1 Answer 1


Systemd journal data is not stored in plain text. It is designed to be read through the journalctl tool. If you wish, you can use strace to confirm that journalctl is indeed reading files from /run/log/journal, among other places:

strace journalctl 2>&1 | grep /run/log/journal/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .