I have read this question, but it discusses
syslog and my question is about
journald. Can I mount
/var/log/journal as tmpfs using
fstab, or will
journald be run (and therefore maybe write to the directory) before the kernel reads
If you don't want journald's logs stored on disk then use the
Storage=volatile setting in
/etc/systemd/journald.conf - there's no need to mess around with mounting /var/log/journal as tmpfs.
Controls where to store journal data. One of "volatile", "persistent", "auto" and "none".
If "volatile", journal log data will be stored only in memory, i.e. below the /run/log/journal hierarchy (which is created if needed).
If "persistent", data will be stored preferably on disk, i.e. below the /var/log/journal hierarchy (which is created if needed), with a fallback to /run/log/journal (which is created if needed), during early boot and if the disk is not writable.
"auto" behaves like "persistent" if the /var/log/journal directory exists, and "volatile" otherwise (the existence of the directory controls the storage mode).
"none" turns off all storage, all log data received will be dropped (but forwarding to other targets, such as the console, the kernel log buffer, or a syslog socket will still work).
Defaults to "auto" in the default journal namespace, and "persistent" in all others.