The assumed default setting in /etc/systemd/journald.conf
is Storage=auto
which implies that systemd journaling will only persist the journal if the expected storage location is available. Otherwise, the journal data is stored in memory and lost between reboots. On Ubuntu 16.04, /var/log/journal
does not exist by default. Create it to keep and query events from previous boots.
Considerations:
- Syslog still provides the persistant log records for Ubuntu 16.04, so enabling persistant systemd journal logging does cause a level of duplicaiton.
- There are sane defaults:
SystemMaxUse
is 10% for peristant storage in/var/log/journal
, or 15% for memory use in/run/log/journal
SystemMaxFiles=100
SystemMaxFileSize
=SystemMaxUse
/8
- More config options such as
MaxLevelStore
can help control how fast storage is consumed.
mkdir -p /var/log/journal
systemd-tmpfiles --create --prefix /var/log/journal
systemctl restart systemd-journald
same with SamuelMarks