Ever since I have "upgraded" to systemd on Arch Linux, I keep losing logs when an unexpected lockup happens. I hit the same log-losing issue one month ago and just hit the issue again. There are also independent other confirmations.
Situation:
- While doing some stuff in Java and with network-related utilities, I saw that KDE (the clock) was frozen. The CPU fan became noisy and the heat was rising. The mouse pointer could still be moved though.
- I tried to ssh from another machine (failed due to "no route to host")
- I waited a few minutes, perhaps the NMI watchdog could kill the offending task. No dice.
- Ctrl + Alt + F1 did not work either, even after SysRq + R
- Since the above steps did not work, I decided to issue the SysRq sequence R-E-I. After E, the screen became black, but no console either. Not even after SysRq + K
- So, this session appears to be lost, the only thing that can be done is gathering debugging information. Looking at Wikipedia, I decided to press SysRq + d (display held locks) among some others.
- After pressing SysRq + S I waited a second and then rebooted with SysRq + B.
- After rebooting and logging into a console, I saw no traces of any crash. The most recently logged entry was from using Wireshark, but there was still a gap of 45 minutes.
(I was running Linux v3.8-rc5-218-ga56e160 btw)
So, how can I make sure that my logs are retained when abnormally rebooting due to a lockup?
systemd
or not? recently I am seeing similar issues. I have posted the details here -> unix.stackexchange.com/questions/414871/…SyncIntervalSec
option (among others) in manjournald.conf(5)
.man jounrnald.conf(5)
: SyncIntervalSec= ... Note that syncing is unconditionally done immediately after a log message of priority CRIT, ALERT or EMERG has been logged. This setting hence applies only to messages of the levels ERR, WARNING, NOTICE, INFO, DEBUG. Doesn't this simply mean that if a critical error is logged it is supposed to be synced "immediately" without waiting for the interval? So meaning that if a critical error happens we are supposed to see it injournald
logs. Am I missing something?!