Display systemd journal's archived logs

JKostaRibeiro · 06-29-2015, 06:20 PM

I have systemd journal's archived logs that I need to view.
How can I do it?

This command is not worthwhile:

Code:

$ journalctl --since=yesterday

It showed me today's logs.

TobiSGD · 06-30-2015, 11:37 AM

I am not quite sure what you are trying to do. If you want to look at archived log files use the -D option.

JKostaRibeiro · 07-01-2015, 06:19 PM

Quote:

Originally Posted by TobiSGD

I am not quite sure what you are trying to do. If you want to look at archived log files use the -D option.

I removed my systemd journal logs at June 25.
So, I must have systemd journal logs from June 26 to July 1 but I can only see logs from June 29 to July 1.
I want to view the logs from June 26 to June 29.
They should have been archived...

Systemd journal log files:

Code:

$ ls -1s /var/log/journal/*/
total 57344
 8192 system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001c5ba-000519acc5b3571d.journal
 8192 system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001fa65-000519ad0ff00bd2.journal
 8192 system.journal
16384 user-1000@ee13e6436422421da906549125cdc0fa-000000000001c5b9-000519acc5b355e5.journal
16384 user-1000.journal

Code:

journalctl --file=system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001c5ba-000519acc5b3571d.journal
-- Logs begin at Seg 2015-06-29 20:05:25 WEST, end at Seg 2015-06-29 20:25:40 WEST. --
.......................................................................................
.......................................................................................
.......................................................................................

$ journalctl --file=system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001fa65-000519ad0ff00bd2.journal
-- Logs begin at Seg 2015-06-29 20:26:10 WEST, end at Seg 2015-06-29 23:02:30 WEST. --
.......................................................................................
.......................................................................................
.......................................................................................

$ journalctl --file=system.journal                                                                   
-- Logs begin at Seg 2015-06-29 23:04:13 WEST, end at Qua 2015-07-01 23:05:39 WEST. --
.......................................................................................
.......................................................................................
.......................................................................................

$ journalctl --file=user-1000@ee13e6436422421da906549125cdc0fa-000000000001c5b9-000519acc5b355e5.journal
-- Logs begin at Seg 2015-06-29 20:05:25 WEST, end at Seg 2015-06-29 20:25:51 WEST. --
.......................................................................................
.......................................................................................
.......................................................................................

$ journalctl --file=user-1000.journal                                                                   
-- Logs begin at Seg 2015-06-29 23:03:16 WEST, end at Qua 2015-07-01 23:11:15 WEST. --
.......................................................................................
.......................................................................................
.......................................................................................

but I think they disappeared...

Here is my journald.conf:

Code:

$ grep -v "#" /etc/systemd/journald.conf 

Storage=persistent
SystemMaxUse=50M
SystemMaxFileSize=16M
RuntimeMaxUse=32M
RuntimeMaxFileSize=12M

Another question: I set SystemMaxUse to 50M but actually systemd journal logs are occupying 57M(57344). Is it normal?

syg00 · 07-01-2015, 09:11 PM

Quote:

Originally Posted by journalctl_manpage

Output is interleaved from all accessible journal files, whether they are rotated or currently being written, and regardless of whether they belong to the system itself or are accessible user journals.

Seems to be true in my case - I have 58 files date-stamped from June last year to today. Journalctl itself shows logs from May 30 2014 to current.

ondoho · 07-03-2015, 04:40 AM

Code:

man journalctl:
--since= --until=

you can specify the absolute dates for which you want to see journals.
relative dates are only yesterday, today and tomorrow (?).

so, if you want everything until yesterday's logs, you would use

Code:

journalctl --until=yesterday

- that would exclude today's logs.