<html> <head> <base href="https://bugs.freedesktop.org/" /> </head> <body> <div> <a class="bz_bug_link bz_status_NEEDINFO " title="NEEDINFO --- - journalctl --since $DATE contains entries from before $DATE" href="https://bugs.freedesktop.org/show_bug.cgi?id=64296#c4">Comment # 4</a> on <a class="bz_bug_link bz_status_NEEDINFO " title="NEEDINFO --- - journalctl --since $DATE contains entries from before $DATE" href="https://bugs.freedesktop.org/show_bug.cgi?id=64296">bug 64296</a> from <a class="email" href="mailto:drizzd@aon.at" title="Clemens Buchacher <drizzd@aon.at>"> Clemens Buchacher</a> <pre>I appear to suffer from the same problem, or multiple problems. In addition to journalctl showing old messages, the messages are also interleaved with newer messages. This is with latest master: v205-133-gc72aadd I see the problem only as root. Even if the journal files are readable to the current user, as a normal user I cannot reproduce this behavior. FWIW, I had a kernel panic on Jul 17 between 17:26 and 14:33, which is why I am looking at the logs. I cannot post my raw journal here because it contains sensitive information. Is it possible to decode them to plain-text, such that I can strip out message contents, then re-encode them? Or is there some way to replace the message contents with dummy placeholders? Do you have any other pointers how to debug this? Is the file format documented? $ date Wed Jul 17 16:45:38 CEST 2013 $ journalctl -D /var/log/journal/7077725e2734c7b16dbbe92a00000b89/ --since="2013-07-17 14:33:24" | head -20 -- Logs begin at Sat 2012-10-20 15:23:13 CEST, end at Wed 2013-07-17 17:08:58 CEST. -- Jul 17 14:33:24 [...] Jul 17 14:33:25 [...] -- Reboot -- Jun 15 10:28:50 [...] -- Reboot -- Jul 17 14:33:25 [...] -- Reboot -- Jun 15 10:28:50 [...]</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the QA Contact for the bug.</li> <li>You are the assignee for the bug.</li> </ul> </body> </html>