I have a user unit running, that is currently failing. I want to know when it started failed, so I'm checking its logs with
journalctl --user -u pycardsyncer.service
However, this is only giving me the logs from the last four hours. Is there a way to get logs from prior to this?
Further, I sometimes see logs with the following:
Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.
Where have these been "rotated" to?
Best Answer
According to
man journalctl
journalctl
reads in journal files as created bysystemd-journald.service
.According to
man systemd-journald.service
the config file is located at/etc/systemd/journald.conf
and it places journal files at/var/log/journal/[machine-id]/*.journal
if it exists, otherwise it places them in/run/log/journal/[machine-id]/*.journal
.Those seem like the relevant files to you. On my machine the journal files were located in
/run/log/journal/[machine-id]/*.journal
If the log files are being rotated too often it's possible that the
SystemMaxUse
orRuntimeMaxUse
are too low in/etc/systemd/journald.conf
.journald
will rotate the file once it reaches the size defined here. Even if it's in the default state the default size is based on your hard drive capacity and can be problematic.