CertGrid CertGrid
Hands-on Lab·Linux Foundation Certified System Administrator

The journal, and what it keeps

The journal is a structured, indexed log with fields you can select on - which makes journalctl | grep the slow, lossy way to use it. This guide covers whether it persists across a reboot, selecting by unit, time, priority and arbitrary field, and the traditional text files that are still being written alongside it.

Operations Deployment Guide 15 of 38 Intermediate

systemd 257 on RHEL 10. Persistence depends on whether /var/log/journal exists, which is a distribution default rather than a systemd one - so check it rather than assuming.

Both families. The RHEL transcript came first, during an outage that took both Ubuntu hosts offline; the Ubuntu half was captured afterwards and is the last step of each page, because Ubuntu is what LFCS is most likely to sit you in front of.
Server NameIP AddressOSRolesCPURAMHDD
LFCS-A01192.168.0.70Ubuntu 26.04 LTSPrimary host - most guides run only here2 Core4 GB50 GB
LFCS-C01192.168.0.72AlmaLinux 10.2The other distribution - dnf, firewalld and NetworkManager2 Core4 GB50 GB

This guide includes

Use this for reading logs on either family. This matters because priorities nest - -p err returns everything more urgent than err as well, so a count that looks like a count of errors is not one.

Before you start

  1. Where the log actually lives, and whether it survives a reboot

  2. Selecting by unit, by time and by boot

  3. Priorities nest, which is why -p err returns more than errors

  4. The fields, which are why it is not a text file

  5. The kernel buffer, and previous boots

  6. The traditional files, which are still being written

  7. Writing to it, and keeping it off the disk

  8. Whether the journal survives a reboot

Official sources

← All LFCS guides