journalctl log disappear?

Service is still active:

systemctl -l status foo.service
● foo.service - My Foo service
 Loaded: loaded (/etc/systemd/system/foo.service; static; vendor preset: disabled)
 Active: activating (start) since Fri 2019-01-18 00:08:45 EST; 18h ago
 Main PID: 29032 (bash)
 CGroup: /system.slice/foo.service
 ├─ 4159 ssh: /root/....

This morning I was able to tail the logs with -f -u foo.service. But now I see this instead:

sudo journalctl -u foo.service
-- No entries --

sudo journalctl -f -u foo.service
-- Logs begin at Wed 2019-01-16 10:18:52 EST. --

I have another service (well, a timer to be exact) completed and log is also unavailable now.

How do I view old logs? I've tried using --since yesterday and _PID= for example, and it only returns to me system logs.

edited Jan 19 at 0:22

Jeff Schaller

40.9k1056130

asked Jan 18 at 23:55

CppLearner

195210

I hope it's not the recent bug/exploit

– Jeff Schaller
Jan 19 at 2:26

How have you proven that any journal entries at all prior to Wednesday even exist any more? How have you determined where your journal has rotated to?

– JdeBP
Jan 19 at 10:34

@JdeBP that's part of my question I am guessing: it seems like default on CentOS is saving to /run/log which according to some thread here it's volatile and not persistent.

– CppLearner
Jan 19 at 14:59

add a comment |

Service is still active:

systemctl -l status foo.service
● foo.service - My Foo service
 Loaded: loaded (/etc/systemd/system/foo.service; static; vendor preset: disabled)
 Active: activating (start) since Fri 2019-01-18 00:08:45 EST; 18h ago
 Main PID: 29032 (bash)
 CGroup: /system.slice/foo.service
 ├─ 4159 ssh: /root/....

This morning I was able to tail the logs with -f -u foo.service. But now I see this instead:

sudo journalctl -u foo.service
-- No entries --

sudo journalctl -f -u foo.service
-- Logs begin at Wed 2019-01-16 10:18:52 EST. --

I have another service (well, a timer to be exact) completed and log is also unavailable now.

How do I view old logs? I've tried using --since yesterday and _PID= for example, and it only returns to me system logs.

edited Jan 19 at 0:22

Jeff Schaller

40.9k1056130

asked Jan 18 at 23:55

CppLearner

195210

I hope it's not the recent bug/exploit

– Jeff Schaller
Jan 19 at 2:26

How have you proven that any journal entries at all prior to Wednesday even exist any more? How have you determined where your journal has rotated to?

– JdeBP
Jan 19 at 10:34

@JdeBP that's part of my question I am guessing: it seems like default on CentOS is saving to /run/log which according to some thread here it's volatile and not persistent.

– CppLearner
Jan 19 at 14:59

add a comment |

Service is still active:

systemctl -l status foo.service
● foo.service - My Foo service
 Loaded: loaded (/etc/systemd/system/foo.service; static; vendor preset: disabled)
 Active: activating (start) since Fri 2019-01-18 00:08:45 EST; 18h ago
 Main PID: 29032 (bash)
 CGroup: /system.slice/foo.service
 ├─ 4159 ssh: /root/....

This morning I was able to tail the logs with -f -u foo.service. But now I see this instead:

sudo journalctl -u foo.service
-- No entries --

sudo journalctl -f -u foo.service
-- Logs begin at Wed 2019-01-16 10:18:52 EST. --

I have another service (well, a timer to be exact) completed and log is also unavailable now.

How do I view old logs? I've tried using --since yesterday and _PID= for example, and it only returns to me system logs.

edited Jan 19 at 0:22

Jeff Schaller

40.9k1056130

asked Jan 18 at 23:55

CppLearner

195210

Service is still active:

systemctl -l status foo.service
● foo.service - My Foo service
 Loaded: loaded (/etc/systemd/system/foo.service; static; vendor preset: disabled)
 Active: activating (start) since Fri 2019-01-18 00:08:45 EST; 18h ago
 Main PID: 29032 (bash)
 CGroup: /system.slice/foo.service
 ├─ 4159 ssh: /root/....

This morning I was able to tail the logs with -f -u foo.service. But now I see this instead:

sudo journalctl -u foo.service
-- No entries --

sudo journalctl -f -u foo.service
-- Logs begin at Wed 2019-01-16 10:18:52 EST. --

I have another service (well, a timer to be exact) completed and log is also unavailable now.

How do I view old logs? I've tried using --since yesterday and _PID= for example, and it only returns to me system logs.

systemd systemd-journald

edited Jan 19 at 0:22

Jeff Schaller

40.9k1056130

asked Jan 18 at 23:55

CppLearner

195210

edited Jan 19 at 0:22

Jeff Schaller

40.9k1056130

asked Jan 18 at 23:55

CppLearner

195210

edited Jan 19 at 0:22

Jeff Schaller

40.9k1056130

edited Jan 19 at 0:22

Jeff Schaller

40.9k1056130

edited Jan 19 at 0:22

Jeff Schaller

40.9k1056130

asked Jan 18 at 23:55

CppLearner

195210

asked Jan 18 at 23:55

CppLearner

195210

asked Jan 18 at 23:55

CppLearner

195210

I hope it's not the recent bug/exploit

– Jeff Schaller
Jan 19 at 2:26

How have you proven that any journal entries at all prior to Wednesday even exist any more? How have you determined where your journal has rotated to?

– JdeBP
Jan 19 at 10:34

@JdeBP that's part of my question I am guessing: it seems like default on CentOS is saving to /run/log which according to some thread here it's volatile and not persistent.

– CppLearner
Jan 19 at 14:59

add a comment |

I hope it's not the recent bug/exploit

– Jeff Schaller
Jan 19 at 2:26

How have you proven that any journal entries at all prior to Wednesday even exist any more? How have you determined where your journal has rotated to?

– JdeBP
Jan 19 at 10:34

@JdeBP that's part of my question I am guessing: it seems like default on CentOS is saving to /run/log which according to some thread here it's volatile and not persistent.

– CppLearner
Jan 19 at 14:59

I hope it's not the recent bug/exploit

– Jeff Schaller
Jan 19 at 2:26

How have you proven that any journal entries at all prior to Wednesday even exist any more? How have you determined where your journal has rotated to?

– JdeBP
Jan 19 at 10:34

@JdeBP that's part of my question I am guessing: it seems like default on CentOS is saving to /run/log which according to some thread here it's volatile and not persistent.

– CppLearner
Jan 19 at 14:59

add a comment |

0

active

oldest

votes

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);

);

draft saved

draft discarded

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f495374%2fjournalctl-log-disappear%23new-answer', 'question_page');

);

Post as a guest

Name

Required, but never shown

0

active

oldest

votes

0

active

oldest

votes

draft saved

draft discarded

Thanks for contributing an answer to Unix & Linux Stack Exchange!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

搜尋此網誌

mjhjmtu