How to see previous logs with systemd

systemd

I have a user unit running, that is currently failing. I want to know when it started failed, so I'm checking its logs with

journalctl --user -u pycardsyncer.service

However, this is only giving me the logs from the last four hours. Is there a way to get logs from prior to this?

Further, I sometimes see logs with the following:

Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.

Where have these been "rotated" to?

Best Answer

According to man journalctl journalctl reads in journal files as created by systemd-journald.service.

According to man systemd-journald.service the config file is located at /etc/systemd/journald.conf and it places journal files at /var/log/journal/[machine-id]/*.journal if it exists, otherwise it places them in /run/log/journal/[machine-id]/*.journal.

Those seem like the relevant files to you. On my machine the journal files were located in /run/log/journal/[machine-id]/*.journal

If the log files are being rotated too often it's possible that the SystemMaxUse or RuntimeMaxUse are too low in /etc/systemd/journald.conf. journald will rotate the file once it reaches the size defined here. Even if it's in the default state the default size is based on your hard drive capacity and can be problematic.