Hello Community,
if realised that a fresh installed AlmaLinux doesn’t have persistent journalctl logging not persistent. Means when there was a reboot all logging infos are gone. Should this be normal, or do I make a mistake while installing. Several time I wanted to follow up a problem, which was solved by the reboot, but without the journalctl data it makes now senses. What is the best way to store logging data of the system to follow up any problems. Is there a standard procedure?
Thanks in advance .
I don’t know if this is the ‘standard’ proceedure, but you can get persistent logging.
My rough notes say
/usr/bin/systemd-tmpfiles --create --prefix /var/log/journal/
and edit /etc/systemd/journald.conf to add Storage=persistent
man systemd-journald writes:
On systems where /var/log/journal/ does not exist yet but where persistent logging is desired (and the default journald.conf is used), it is sufficient to create the directory, and ensure it has the correct access modes and ownership:
mkdir -p /var/log/journal
systemd-tmpfiles --create --prefix /var/log/journal
and then (if not rebooting immediately):
journalctl --flush
Yes, the persistent log is not the default. You should ask Red Hat why they opt to not write to disk.
However, on most setups, the ‘rsyslog’ is still included and it does write to its legacy format (some of) journald’s content. Furthermore, logrotate rules for rsyslog are not installed by default.
Thank you for the Info,
is there an option to set this up in the installation, maybe ?
Probably not in the interactive installer.
If one does use kickstart, then its post section should be able to run the commands.
Personally, I do minimal install and then run Ansible playbooks to drop in config. Could have tasks for this.