10

I have a user unit running, that is currently failing. I want to know when it started failed, so I'm checking its logs with

journalctl --user -u pycardsyncer.service

However, this is only giving me the logs from the last four hours. Is there a way to get logs from prior to this?

Further, I sometimes see logs with the following:

Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.

Where have these been "rotated" to?

Community
  • 1
Sparhawk
  • 19,941

1 Answers1

8

According to man journalctl journalctl reads in journal files as created by systemd-journald.service.

According to man systemd-journald.service the config file is located at /etc/systemd/journald.conf and it places journal files at /var/log/journal/[machine-id]/*.journal if it exists, otherwise it places them in /run/log/journal/[machine-id]/*.journal.

Those seem like the relevant files to you. On my machine the journal files were located in /run/log/journal/[machine-id]/*.journal

If the log files are being rotated too often it's possible that the SystemMaxUse or RuntimeMaxUse are too low in /etc/systemd/journald.conf. journald will rotate the file once it reaches the size defined here. Even if it's in the default state the default size is based on your hard drive capacity and can be problematic.

ewatt
  • 463
Centimane
  • 4,490
  • Thanks for the answer. I had some files at /var/log/journal/[machine-id]/*.journal, but they only contained the data as per my question; they didn't go back further than that. (I had nothing at /run/log/journal.) FWIW my uptime is 3 days, but these logs seem to go back only ~5 hours. – Sparhawk Jun 07 '16 at 11:31
  • @Sparhawk did you take a look in /etc/systemd/journald.conf to see what's configured? – Centimane Jun 08 '16 at 11:22
  • @Dave4 Yes, I did. I'm running Arch, so it's basically as default. There's no reference to any path at all, but there are recent logs in the directory you named (as per my first comment), so I figured that must be correct… just truncated. – Sparhawk Jun 08 '16 at 11:31
  • @Sparhawk is the file that's kept always the same size? It may be that it is getting too large for the default SystemMaxUse or RuntimeMaxUse. If that happens the default values will still cause it to be rotated. What is the size of your HD? – Centimane Jun 08 '16 at 11:39
  • Ahhh! Yes, sorry. The one thing that I did change from default was to limit how much disk space it used with SystemMaxUse=50M. Indeed, /var/log/journal/[machine-id] contains 69M. Thanks for pointing me in the right direction. If you add this information to your answer, I'll accept it. (Please reply here when you've done it.) Cheers! – Sparhawk Jun 09 '16 at 00:07
  • @Sparhawk added the info to the answer – Centimane Jun 09 '16 at 13:35