My question is, how can I find boot log from previous system boot attempt?
Today when first powering on my PC, boot process stopped on Ubuntu logo, when I pressed Esc I have seen several lines containing some kernel error and restart required at the bottom, so I pressed Ctrl+ALt+Del and next boot went OK without problems.
I have trouble finding messages from the screen I have seen during the first unsuccessful boot. Should I have taken picture to my phone?
/var/log/boot
is there but empty, I searched kern.log and syslog for strings I remembered with today's date like error
but found nothing familiar to what I have seen on previous boot screen.
$ journalctl -b -1
gives me only kernel messages during boot, I can find that elsewhere too, and they are not what was appearing on screen during boot, journalctl is useless for me, I am looking for messages appearing on screen during boot time.
For now, only option is take a photo of write the message on paper.
Reported as a bug that's an undocumented feature
There is a bug report filed on this topic. Because
rsyslog
already maintains multiple boot journals in/var/log/syslog
andsyslog.1
,.2.gz
,.3.gz
...syslog.7.gz
the developers felt keeping extrajournalctl
logs would waste disk space.The bug report states on January 3, 2018 that for new installs
rsyslog
will no longer be the default and thatjournalctl
will keep multiple boot data logs.Create multiple boot logs without reinstalling Ubuntu
Most of us won't do a new install so to enable multiple
journalctl
boot logs in which case we can use:According to this github report the warning message "Cannot set file attribute" can be ignored.
Optional persistent storage setting
After using previous boot logging for many months I've discovered another option that can be set in
/etc/systemd/journald.conf
:From journald.conf man page:
In a nutshell remove the comment and revise the line to:
Display list of previous boots
Display last boot log
Pay close attention to the parameter
-b-1
it is different than other references you may see. From man page:Then every once in a while, with
cron
or timers you may clean old logs:I had the same issue, and apparently found the answer on the
#ubuntu
irc-channel.For whatsoever reason, I was missing the folder
/var/log/journal
group-accessible to systemd-journal.After adding the folder, I was able to see logs of previous boots via
$ journalctl -b1
The steps to accomplish the solution from the top answer here, from the man page for systemd-journald:
I did this as su
Use
journalctl -bX
where x is the boot you refer to, so-b0
is your actual boot and-b-1
the boot before (which only works if you have the folder/var/log/journal
belonging to group 'systemd-journal' present). Cant tell you how far exactly you can go but those two for sure.List available boots with
The answer can be found in
man journald.conf
, specifically the optionStorage=
:Please keep in mind that there is no need for log rotation or similar techniques that were common with the old syslog daemon. The journal file is by default configured to grow to a certain size and old log entries are automatically deleted when the journal file grows too large.
On my system this size is currently configured as 120MB, you can adjust it in
/etc/systemd/journald.conf
for the systemd-journald.service unit.