I know systemd-journald keeps its logs in-memory by default.
Does anyone know what the limit is for these logs and how to increase it? From the banner at the top it seems like it is only keeping them for 3 hours:
-- Logs begin at Tue 2018-11-20 06:40:21 CET, end at Tue 2018-11-20 09:56:45 CET. -- I want systemd-journald to log more, but I don't want to turn on persistence because it's running on a Raspberry Pi and I want to prevent the SD card from going corrupt because of the writes.
The relevant options from journald.conf when using volatile storage are the ones prefixed with "Runtime":
RuntimeMaxUse=, RuntimeKeepFree=, RuntimeMaxFileSize= and RuntimeMaxFiles=
Per the manual:
The options prefixed with "Runtime" apply to the journal files when stored on a volatile in-memory file system, more specifically
/run/log/journal
so you'll have to play with:
RuntimeMaxUse= how much space logs can take up in the /run file system
and
RuntimeKeepFree= how much free space that should remain in the /run file system after logs are saved
Per the same manual, systemd-journald will respect both limits and use the smaller of the two values: the first one defaults to 10% and the second to 15% of the size of the respective file system, but each value is capped to 4G.
Do note that those options accept only absolute values + unit.
in your journald config file:
/etc/systemd/journald.conf
You should have some predefined options. dehash the option:
Storage=persistant
and then create the a journal directory in /var/log/journal. If the directory is not there, journald will not store logs between reboots.
sudo mkdir /var/log/journal Also the flags -a "all" and -m "merege" will collect all the logs even from other users. and then using --since will give you solid ranges.
journalctl --since "2018-01-01 08:30:00" -xema adding -f will give you follow and show logs as they come in
