Home / server / Questions / 1051439
In Process
Jack BeNimble
Asked: 2021-01-28 09:16:05 +0800 CST

How to view journalctl without rebooting system in RHEL 7/8?

  • 772

We're having issues with a customer having RedHat 7 PC's shutdown intermittently.

One was just sent in for repair, and I'd like to check the journald output.

However, I've read the rebooting the system overwrites it.

How can I view this journal without rebooting the system? Do I need a bootable RedHat or Centos USB stick? If so, how to I create it? How would I then view the drive/file?

redhat journalctl

3 Answers

  1. If it was shut down already, you'll have no luck. By default, Journald on CentOS 7/8 is storing log data in RAM.

    You can ensure Journald logs data in persistent mode, by simply creating /var/log/journal:

    # create the directory
mkdir -p /var/log/journal
# ensure the write permissions
systemd-tmpfiles --create --prefix /var/log/journal
# ping the daemon that the directory is there
killall -USR1 systemd-journald

    This however, applies to currently booted machine and further reboots will have the data retained.

    • 2

  2. Typically the data is stored in the /var/log directory. To configure the logging details see:

    https://www.freedesktop.org/software/systemd/man/journald.conf.html

    Setting Storage=persistent will ensure the data is written to disk.

    The following values can be used to control the size limits: SystemMaxUse=, SystemKeepFree=, SystemMaxFileSize=, SystemMaxFiles=, RuntimeMaxUse=, RuntimeKeepFree=, RuntimeMaxFileSize=, RuntimeMaxFiles=

    Files can then be read searched using journalctl.

    • 1

  3. You can edit the configuration file in /etc/systemd/journald.conf & make storage=persistant and then it will store all the logs in   /var/log/journal.

    • 0