0

I am not able to find /var/log/messages under journald. Is there any way I can integrate journald with /var/log/messages such that journalctl shows logs from /var/log/messages?

1 Answer 1

1

Unless you have changed the configuration related to the logging system, Journald is absolutely not guaranteed to have everything that is in /var/log/messages.

Following up with this post about LEMP troubleshooting with journalctl, the default setup work in a way that only a fraction of messages are actually stored in Journald:

Both are installed and running:

  • Journald runs without persistent storage and stores log data only in RAM
  • Rsyslog (aka /var/log/messages and friends) persists log data to flat files ...

Rsyslog will persist much of the logs, while Journald will store only a fraction of already-persisted messages, in RAM.

If you want both log storages (Journald and Rsyslog) to be on par, at very minimum you should allocate persistent storage on the file system, and/or increase the RAM for Journald logs.

To make for a persistent storage, you'd simply create /var/log/journal directory and reload Journald daemon:

# create the directory
mkdir -p /var/log/journal
# ensure the write permissions
systemd-tmpfiles --create --prefix /var/log/journal
# ping the daemon that the directory is there
killall -USR1 systemd-journald

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .