I am not able to find /var/log/messages under journald. Is there any way I can integrate journald with /var/log/messages such that journalctl shows logs from /var/log/messages?
Unless you have changed the configuration related to the logging system, Journald is absolutely not guaranteed to have everything that is in
Following up with this post about LEMP troubleshooting with journalctl, the default setup work in a way that only a fraction of messages are actually stored in Journald:
Both are installed and running:
- Journald runs without persistent storage and stores log data only in RAM
- Rsyslog (aka /var/log/messages and friends) persists log data to flat files ...
Rsyslog will persist much of the logs, while Journald will store only a fraction of already-persisted messages, in RAM.
If you want both log storages (Journald and Rsyslog) to be on par, at very minimum you should allocate persistent storage on the file system, and/or increase the RAM for Journald logs.
To make for a persistent storage, you'd simply create
/var/log/journal directory and reload Journald daemon:
# create the directory mkdir -p /var/log/journal # ensure the write permissions systemd-tmpfiles --create --prefix /var/log/journal # ping the daemon that the directory is there killall -USR1 systemd-journald