I am running Arch-ARM on RPi3. I have noticed when system crashes I cannot find any related crash log in journal logs.

Arch Linux ARM on RPi3: Linux 4.4.37-1-ARCH #1 SMP armv7l GNU/Linux

Systemd: systemd 232



Recent crash log:

Dec 29 03:43:48 sudo[21861]:  my_user : TTY=unknown ; PWD=/opt/my_app/repo/src ; USER=root ; COMMAND=/usr/sbin/hciconfig hci0 reset
Dec 29 03:43:48 sudo[21861]: pam_unix(sudo:session): session opened for user root by (uid=0)
Dec 29 03:43:48 sudo[21861]: pam_unix(sudo:session): session closed for user root
Dec 29 03:43:48 my_app.py[17773]: trying to connect to XX:XX:XX:XX:XX:XX
Dec 29 03:43:48 systemd-udevd[21865]: Process '/bin/hciconfig hci0:64 up' failed with exit code 1.
Dec 29 03:43:51 my_app.py[17773]: connection successful :)
-- Reboot --
Jan 03 16:31:25 systemd[1]: Time has been changed
Jan 03 16:31:26 dhcpcd[470]: forked to background, child pid 587
Jan 03 16:31:25 systemd-timesyncd[360]: Synchronized to time server (2.arch.pool.ntp.org).
Jan 03 16:31:25 systemd[1]: Starting Update man-db cache...
Jan 03 16:31:25 systemd[1]: Starting Rotate log files...
Jan 03 16:31:25 systemd[1]: Started Verify integrity of password and group files.
Jan 03 16:31:25 systemd[1]: ssh-tunnel.service: Service hold-off time over, scheduling restart.

Looks like that somehow journald is failing to sync logs when a crash happens.

  • Is this a known behaviour?
  • Is there a workaround for this?

Also I am curious to know if the following claim from Arch Linux wiki is still valid:

Since the syslog component of systemd, journald, does not flush its logs to disk during normal operation, these logs will be gone when the machine is shut down abnormally (power loss, kernel lock-ups, ...). In the case of kernel lock-ups, it is pretty important to have some kernel logs for debugging. Until journald gains a configuration option for flushing kernel logs, rsyslog can be used in conjunction with journald.

related bug report (old): Bug 61411 - All logs since last boot gone after crash/hard reboot

similar issue (old): Debugging lock-up - systemd loses my logs

  • That is not the output of journalctl, which would have an additional field. – JdeBP Jan 4 '18 at 23:18
  • @JdeBP I have removed hostname if that is what you are referring to! – kaptan Jan 5 '18 at 0:54
  • any comment on how to improve the question to get some answers? – kaptan Jan 19 '18 at 19:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.