I am not able to find /var/log/messages under journald. Is there any way I can integrate journald with /var/log/messages such that journalctl shows logs from /var/log/messages?


Unless you have changed the configuration related to the logging system, Journald is absolutely not guaranteed to have everything that is in /var/log/messages.

Following up with this post about LEMP troubleshooting with journalctl, the default setup work in a way that only a fraction of messages are actually stored in Journald:

Both are installed and running:

  • Journald runs without persistent storage and stores log data only in RAM
  • Rsyslog (aka /var/log/messages and friends) persists log data to flat files ...

Rsyslog will persist much of the logs, while Journald will store only a fraction of already-persisted messages, in RAM.

If you want both log storages (Journald and Rsyslog) to be on par, at very minimum you should allocate persistent storage on the file system, and/or increase the RAM for Journald logs.

To make for a persistent storage, you'd simply create /var/log/journal directory and reload Journald daemon:

# create the directory
mkdir -p /var/log/journal
# ensure the write permissions
systemd-tmpfiles --create --prefix /var/log/journal
# ping the daemon that the directory is there
killall -USR1 systemd-journald

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.