40 - journalctl

Checking journalctl Status

student@localhost:~$ systemctl status systemd-journald

● systemd-journald.service - Journal Service

     Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static)

     Active: active (running) since Fri 2026-09-25 15:16:54 +08; 3min 20s ago

 Invocation: e1f13e40078f4b038cef148331979c49

TriggeredBy: ○ systemd-journald-audit.socket

             ● systemd-journald-dev-log.socket

             ● systemd-journald.socket

       Docs: man:systemd-journald.service(8)

             man:journald.conf(5)

   Main PID: 7547 (systemd-journal)

     Status: "Processing requests..."

      Tasks: 1 (limit: 22995)

   FD Store: 90 (limit: 4224)

     Memory: 12.6M (peak: 12.8M)

        CPU: 248ms

     CGroup: /system.slice/systemd-journald.service

             └─7547 /usr/lib/systemd/systemd-journald

Sep 25 15:18:24 localhost.localdomain systemd-journald[7547]: /var/log/journal/a6bc2c1625c94353ba65ae990fba8767/system.journal: Journal file has been delete>

Sep 25 15:18:24 localhost.localdomain systemd-journald[7547]: Failed to create new system journal: No such file or directory

Notice: journal has been rotated since unit was started, output may be incomplete.

student@localhost:~$ journalctl --disk-usage

Archived and active journals take up 8M in the file system.

Verify The Journal Configuration File

student@localhost:~$ sudo vim /usr/lib/systemd/journald.conf 

student@localhost:~$ cat /usr/lib/systemd/journald.conf 

#  This file is part of systemd.

#

#  systemd is free software; you can redistribute it and/or modify it under the

#  terms of the GNU Lesser General Public License as published by the Free

#  Software Foundation; either version 2.1 of the License, or (at your option)

#  any later version.

#

# Entries in this file show the compile time defaults. Local configuration

# should be created by either modifying this file (or a copy of it placed in

# /etc/ if the original file is shipped in /usr/), or by creating "drop-ins" in

# the /etc/systemd/journald.conf.d/ directory. The latter is generally

# recommended. Defaults can be restored by simply deleting the main

# configuration file and all drop-ins located in /etc/.

#

# Use 'systemd-analyze cat-config systemd/journald.conf' to display the full config.

#

# See journald.conf(5) for details.

[Journal]

#Storage=auto

#Compress=yes

#Seal=yes

#SplitMode=uid

#SyncIntervalSec=5m

#RateLimitIntervalSec=30s

#RateLimitBurst=10000

#SystemMaxUse=

#SystemKeepFree=

#SystemMaxFileSize=

#SystemMaxFiles=100

#RuntimeMaxUse=

#RuntimeKeepFree=

#RuntimeMaxFileSize=

#RuntimeMaxFiles=100

#MaxRetentionSec=0

#MaxFileSec=1month

#ForwardToSyslog=no

#ForwardToKMsg=no

#ForwardToConsole=no

#ForwardToWall=yes

#TTYPath=/dev/console

#MaxLevelStore=debug

#MaxLevelSyslog=debug

#MaxLevelKMsg=notice

#MaxLevelConsole=info

#MaxLevelWall=emerg

#MaxLevelSocket=debug

#LineMax=48K

#ReadKMsg=yes

Audit=

Making The Journal Persistent

student@localhost:~$ sudo mkdir /var/log/journal

student@localhost:~$ systemctl restart systemd-journald

student@localhost:~$ sudo journalctl --flush

student@localhost:~$ cat /etc/machine-id

a6bc2c1625c94353ba65ae990fba8767

student@localhost:~$ ls -la /var/log/journal

total 4

drwxr-xr-x.  3 root root   46 Sep 25 15:22 .

drwxr-xr-x. 18 root root 4096 Sep 25 15:22 ..

drwxr-xr-x.  2 root root   53 Sep 25 15:22 a6bc2c1625c94353ba65ae990fba8767

Cleanup

student@localhost:~$ sudo systemctl stop systemd-journald.service systemd-journald.socket

Stopping 'systemd-journald.service', but its triggering units are still active:

systemd-journald-dev-log.socket

student@localhost:~$ sudo rm -rf /var/log/journal

student@localhost:~$ systemctl start systemd-journald

student@localhost:~$ ls -la /var/log/journal

ls: cannot access '/var/log/journal': No such file or directory