Quote:
Originally Posted by TobiSGD
I am not quite sure what you are trying to do. If you want to look at archived log files use the -D option.
|
I removed my systemd journal logs at June 25.
So, I must have systemd journal logs from June 26 to July 1 but I can only see logs from June 29 to July 1.
I want to view the logs from June 26 to June 29.
They should have been archived...
Systemd journal log files:
Code:
$ ls -1s /var/log/journal/*/
total 57344
8192 system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001c5ba-000519acc5b3571d.journal
8192 system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001fa65-000519ad0ff00bd2.journal
8192 system.journal
16384 user-1000@ee13e6436422421da906549125cdc0fa-000000000001c5b9-000519acc5b355e5.journal
16384 user-1000.journal
Code:
journalctl --file=system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001c5ba-000519acc5b3571d.journal
-- Logs begin at Seg 2015-06-29 20:05:25 WEST, end at Seg 2015-06-29 20:25:40 WEST. --
.......................................................................................
.......................................................................................
.......................................................................................
$ journalctl --file=system@bcaa2f2178c7450d9ab5bb5d1c496892-000000000001fa65-000519ad0ff00bd2.journal
-- Logs begin at Seg 2015-06-29 20:26:10 WEST, end at Seg 2015-06-29 23:02:30 WEST. --
.......................................................................................
.......................................................................................
.......................................................................................
$ journalctl --file=system.journal
-- Logs begin at Seg 2015-06-29 23:04:13 WEST, end at Qua 2015-07-01 23:05:39 WEST. --
.......................................................................................
.......................................................................................
.......................................................................................
$ journalctl --file=user-1000@ee13e6436422421da906549125cdc0fa-000000000001c5b9-000519acc5b355e5.journal
-- Logs begin at Seg 2015-06-29 20:05:25 WEST, end at Seg 2015-06-29 20:25:51 WEST. --
.......................................................................................
.......................................................................................
.......................................................................................
$ journalctl --file=user-1000.journal
-- Logs begin at Seg 2015-06-29 23:03:16 WEST, end at Qua 2015-07-01 23:11:15 WEST. --
.......................................................................................
.......................................................................................
.......................................................................................
but I think they disappeared...
Here is my journald.conf:
Code:
$ grep -v "#" /etc/systemd/journald.conf
Storage=persistent
SystemMaxUse=50M
SystemMaxFileSize=16M
RuntimeMaxUse=32M
RuntimeMaxFileSize=12M
Another question: I set SystemMaxUse to 50M but actually systemd journal logs are occupying 57M(57344). Is it normal?