1

From what I have learned, Centos 7 (by default) keeps log journal entries in memory only so these are lost when machine is rebooted. I'm comfortable with the fact that I can only see messages from current boot.

Putting syslog forwarding aside, how can I list all of the entries already stored in journal for the current boot? I tried:

[root@box ~]# journalctl -b 0
-- Logs begin at Wed 2015-12-02 16:32:14 CET, end at Wed 2015-12-02 18:09:55 CET. --

but it doesn't show old entries, only the entries for (as you can see) the past few hours.
My machine has actually been running for several days, though:

[root@box ~]# uptime
 18:12:38 up 19 days,  4:28,  1 user,  load average: 0.34, 0.39, 0.57

I'd like to see the logs for that whole period.

sourcejedi
  • 50,249
shellbro
  • 140
  • Perhaps: http://unix.stackexchange.com/questions/159221/how-display-log-messages-from-previous-boots-under-centos-7?rq=1 – JRFerguson Dec 02 '15 at 17:45
  • 1
    @JRFerguson not really. What you linked is asking: "How to retain and display logs from previous boots?". I'm comfortable with the fact that I can only see messages from current boot. But the question is how to show everything. – shellbro Dec 02 '15 at 19:04
  • Take a look at http://unix.stackexchange.com/questions/159221/how-display-log-messages-from-previous-boots-under-centos-7 and make sure you have persistent journal logs – VenkatC Dec 03 '15 at 00:42
  • see http://www.freedesktop.org/software/systemd/man/journald.conf.html#SystemMaxUse= – Evgeny Dec 05 '15 at 01:15

1 Answers1

-1

I see the issue you are facing, on my hosts, I do not observe the same behavior. It shows correct information.For example see below

[root@centos7 ~]# uptime
 19:53:40 up 13 days,  6:10,  1 user,  load average: 0.06, 0.13, 0.20
[root@centos7 ~]# 
[root@centos7 ~]# journalctl -b |head -1
-- Logs begin at Sat 2015-11-21 13:42:51 EST, end at Fri 2015-12-04 19:48:26 EST. --

So, it must be something specific to your setup. Can you check, how big is the journal file? Is there any customization in your setup for journalctl like journal size restrictions? what is the output of journalctl --disk-usage ?

EDIT: You will see a line something similar to below on your host. Once the default limits are reached and if you do not have persistent storage, that log is gone and journalctl -b could only display whatever the oldest available log messages

Nov 21 13:43:27 xxxxxx-hostname systemd-journal[81]: Runtime journal is using 8.0M (max 74.8M, leaving 112.3M of free 740.6M, current limit 74.8M).
VenkatC
  • 2,175