I am trying to understand what journald does in relation to persistent storage of log entries. I have an SDCard setup so I am looking to keep disk writes to a minimum, but would like some persistence in logging via journald.

Out of the box (Raspbian) journald uses Storage=auto i.e. unless there is a mount for /var/log/journal it will simply store all logs to RAM.

The question is, if there is a mount point /var/log/journal, does journald continue to use RAM where it can, or does it default to writing everything to disk?

If it does write to RAM primarily, what default mechanisms are setup to manage the persistence of logs?

1 Answer 1


Extract from journal.conf manpage

           Controls where to store journal data. One of "volatile", "persistent", "auto" and "none". If "volatile", journal log data
           will be stored only in memory, i.e. below the /run/log/journal hierarchy (which is created if needed). If "persistent",
           data will be stored preferably on disk, i.e. below the /var/log/journal hierarchy (which is created if needed), with a
           fallback to /run/log/journal (which is created if needed), during early boot and if the disk is not writable.  "auto" is
           similar to "persistent" but the directory /var/log/journal is not created if needed, so that its existence controls where
           log data goes.  "none" turns off all storage, all log data received will be dropped. Forwarding to other targets, such as
           the console, the kernel log buffer, or a syslog socket will still work however. Defaults to "auto".

According to me, in auto mode, the sentence so that its existence controls where log data goes clearly states that :

  • without /var/log/journal, logs are only written to /run/log/journal
  • with /var/log/journal, logs are only written to /var/log/journal
  • In that case, why would you need the flush command to clear data from /run/log/journal to /var/log/journal. It implies some caching.
    – Brian
    Apr 19, 2019 at 11:02
  • 1
    From journalctl --flushmanpage, the data is only flushed from /run/log/journal into /var/log/journal once during system runtime. From source code [github.com/systemd/systemd/blob/master/src/journal/… you can see that once the /run/systemd/journal/flushed exists, this command does nothing (also explained in the man page). So, it is most probably used when you move from volatile to persistent storage on a running system. Apr 19, 2019 at 12:30
  • This answer is correct, bar the small exception if /var/log isn't writable during early boot. I looked into this and on Ubuntu where I have a separate volume to mount for /var/log, during boot, /run/log/journald is used at first, but then flushed and only /var/log/journald is used. /run/log/journald remained but is empty. Use journalctl --unit=systemd-journald --boot 0 --output cat to check behavior.
    – JPvRiel
    Dec 28, 2022 at 18:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .