Journalctl does not find journal files

:smiley: keep trying!!!

What groups is your user assigned to? (groups).

sys log network floppy scanner power libvirt rfkill users video storage optical lp audio wheel adm my_user

sudo gpasswd -a $USER systemd-journal

Looking back it was September when I first installed, I had the problem immediately after I installed.

No changes.

cat /etc/journald.conf.d/volatile-storage.conf  # <<< Corrected

Returns?

Found the post I made, god that was hard work :sweat_smile:

I don’t have that file.

$ cat /etc/journald.conf.d/volatile-storage.conf
cat: /etc/journald.conf.d/volatile-storage.conf: No such file or directory

And I am out of ideas. Sorry. Will keep searching and report back if I find anything useful.

1 Like

Thanks for all your help! I really appreciate that! :slight_smile:

I actually don’t have that whole folder /etc/journald.conf.d

1 Like

I hope you weren’t so busy you don’t have a backup strategy. I am hoping there is not a hardware failure and leaning towards a badly corrupted system. :hugs:

Can you expand on that? Why do you think, there is a hardware failure? I have to admit, that I don’t have a backup from before that. I just discovered like 2 weeks ago, that backups are a thing I should do. :grinning:
Is there a way to recover from a corrupted system - other than wipe + reinstall?

What is the result of this command?

cat /etc/systemd/journald.conf | grep "^[^#;]"

Also, what is the result of this command?

cat /etc/systemd/journald.conf.d/* | grep "^[^#;]"

1 Like

This folder does not need to exist. I dont know where this is coming from. If you dont have that directory you should not be worried.

The journald configs are in

/etc/systemd/journald.conf
/etc/systemd/journald.conf.d/

as @kwg pointed out.

No. The folder /var/log/journal contains a subfolder which contains plenty of log files. At least on my PC.

Before you delete anything, you can show us the content:

ls -lR /var/log/journal/

Also, as @kwg already mentioned: What are your journal settings in /etc/systemd/journald.conf

$ cat /etc/systemd/journald.conf | grep "^[^#;]"
[Journal]
Storage=persistent
$ cat /etc/systemd/journald.conf.d/* | grep "^[^#;]"
cat: '/etc/systemd/journald.conf.d/*': No such file or directory

@mbod: originally, Storage was commented (with #).

$ ls -lR /var/log/journal/
/var/log/journal/:
total 8
drwxr-sr-x+ 2 root systemd-journal 4096 Apr 16 14:36 4f5dfe7fc2404aa4902df17e05565c18

/var/log/journal/4f5dfe7fc2404aa4902df17e05565c18:
total 16396
-rw-r-----+ 1 root systemd-journal 8388608 Apr 16 14:41 system.journal
-rw-r-----+ 1 root systemd-journal 8388608 Apr 16 14:41 user-1000.journal

This is after I deleted everything (and did everything else, that was mentioned in this thread).

I’m grasping at straws now for a solution…

Run this command:

cat /etc/machine-id

In your case, I would expect the result to be the following:

4f5dfe7fc2404aa4902df17e05565c18

Now reboot your system. After reboot, run this command again:

cat /etc/machine-id

The result should be the same as it was before the reboot:

4f5dfe7fc2404aa4902df17e05565c18

1 Like

What happens if you run this command instead?

journalctl --merge

Edit: A few more thoughts, still grasping at straws…

Is there plenty of free space in your system partition?

df -h

What is the result of the following command?

journalctl --list-boots

Do you see a long list? Press the End key to find your most recent boots at the bottom.

What is the result of the following command?

sudo journalctl --flush

It should complete without displaying a message.

After running the flush command, reboot immediately:

reboot

After you reboot, run this command once again and look for your previous boot:

journalctl --list-boots

Are you now able to view the log from the previous boot?

journalctl -b -1

No, the ID is not what you think. It also changes after a reboot.
Edit: Now, that I think about it, I did this. I removed the line from crontab - and … it is working. I never thought, that the ID could have this effect. After some searching, I found this explanation. Is there a way to make the journal work with different machine-id’s?

2 Likes

Good! :slightly_smiling_face: So we have found the source of the problem!

It’s not something I have ever needed to do, so I have not tried it. However, it may be possible to view logs associated with a different machine-id:

https://man.archlinux.org/man/journalctl.1

Output is interleaved from all accessible journal files, whether they are rotated or currently being written, and regardless of whether they belong to the system itself or are accessible user journals.

The set of journal files which will be used can be modified using the –user, –system, –directory, and –file options