Journald's advantages over other logging systems such as rsyslog
is that it is very efficient and logs just about everything on your system automatically without the need to configure anything, because it is a part of the systemd
suite. The main disadvantage is that all journald
log information will get lost after a system's restart. Journald logging can produce huge amounts of data and by default all logging information is only kept in memory, which is not very practicable if you need to access older log information or analyze causes of system crash reboots. Here, in this recipe, we show you how to configure journald
to make it persistent.
To complete this recipe, you will require a minimal installation of the CentOS 7 operating system with root privileges and a console-based text editor of your choice.
To begin this recipe, we need to create a location that will hold our persistent journal database:
mkdir /var/log/journal
journald
to use it as a storage location and fix permissions:systemd-tmpfiles --create --prefix /var/log/journal
journald
:systemctl restart systemd-journald
journalctl --boot=-1
We started this recipe by creating the new directory, /var/log/journal
. By default, journald
writes its log database to /run/log/journal
, which is a directory only for runtime information, and its content does not survive system reboots. Afterwards, we used the systemd-tmpfiles
command to set up our new directory for journald
. Finally, we restarted the journald
server daemon to apply our changes to the system. To test if persistence is working, restart your server and afterwards use journalctl –boot=-1
. This will show us all journal information from the last boot. If persistence is not working, it will print out the following error; otherwise it will correctly show all journal messages before the last boot:
Failed to look up boot -1: Cannot assign requested address
In this fairly simple recipe, we have shown how to make journald
persistent over system reboots. This is really useful if you need to review older log files from the past, which can sometimes help you find out problems, for example, the roots of past hardware failures.