Another journal

I’m having a problem with a new install of Debian Jessie on a new laptop. After installing bumblebeenvidia, the system freezes when I boot (keyboard is dead, can’t ssh in). Ah! I thought. Look at the logs. So I booted to another version of Debian on the same machine and looked at /var/log on the iffy system. There were no entries in any files I could see with a date stamp corresponding with the attempted boot. I know how to look at the journal for the currently running system, but how do I view the journal from another system? Where is the file? Ian Couchman Systemd stores its journal files in a number of locations. Volatile logs are kept in /run/log/journal and persistent ones in /var/log/journal. As /run is a tmpfs, its contents disappear on shutdown or reboot, but it’s able to log information before the filesystem containing /var is mounted (the log entries are then synced) so systemd can keep logs right from early boot.

There are options to read logs in a different location, but first you have to make sure you have logs. The Storage option in /etc/ systemd/journald.conf controls where the logs are kept. When set to "volatile" the journal is only saved in /run, a setting of "persistent" also saves to /var/log/journal, creating the directory if necessary. The default is "auto" , which saves to /var/log/journal only if that directory exists (which it doesn’t on a vanilla install of Debian or Ubuntu). To force systemd to save the journal to disk, create the /var/log/journal directory and have it owned by the root user and the :systemd-journal group. Alternatively, change the Storage setting to "persistent" in /etc/systemd/journald. conf. To avoid this being overridden by a subsequent update, it’s best to create a file in /etc/systemd/journald.conf.d, say storage. conf, containing [Journal] Storage=persistent

The default configuration file contains all the settings showing their defaults but commented out. To change them either remove the comment or copy the setting to a file in /etc/systemd/journald.conf.d. Once you have systemd logging to disk, you can access the journal from another system (providing it runs systemd) with journalctl. If you mount your Debian root partition at /mnt/debian, you can now view the journal with one of: $ journalctl --root /mnt/debian $ journalctl --directory /mnt/debian/var/log/ journal

The former is easier, providing your Debian install has /var on the root filesystem. If it’s mounted elsewhere, use the latter example and give the path to the log directory. You can use all of the usual journalctl options to examine and filter the information in the journals as if you were working with the current system’s journal.