[systemd-devel] journalctl not showing most boots/logs

[Jan Janssen]

There are still some journal~ files there. They may not be corrupted, 
but maybe still trip some journal interleaving code up. Can see how it 
fares without those?

Jan

On 2015-03-27 21:44, Michael Biebl wrote:
> # journalctl --verify
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/system at 32eb70b2195d4cf69066be8d99a7a407-0000000000000001-00050f6ed83c9f0d.journal
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/user-1000 at 690216233b624f11a2201e9f98176515-000000000021f2f2-00050c4b51fd09dc.journal
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/user-65534.journal
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/user-109.journal
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/system at 00050f6458a7e3b4-0b0258d981908105.journal~
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/user-1000.journal
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/system at 32eb70b2195d4cf69066be8d99a7a407-0000000000000009-00050f6ee60496f2.journal
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/system at 00050f6483661de1-53b8b8eea3ee8e5e.journal~
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/system.journal
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/user-65534 at 00050f646a4541ba-a7026dec325dbd3f.journal~
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/user-65534 at e4481be943ee4a06b58d3542944446d7-00000000002a7bbc-000511cf7a32c29a.journal
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/system at 000511cfb123cc25-32fec68ddf36aac2.journal~
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/system at 00050e650144ab12-15158e9a9df4f071.journal~
> 7fffee0: unused data
> (entry_offset==0)██████████████████████████████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
>   48%
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/system at 718656154e1546fcb5d438a9edf3155f-0000000000000001-00050c4b51788fe4.journal
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/system at 718656154e1546fcb5d438a9edf3155f-000000000026448b-00050de41b746eac.journal
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/user-1000 at 00050e6501bfa725-1728cb2f60eede7c.journal~
> PASS: /var/log/journal/567a68a5c2672114bcf5192d00000008/system at 85e08ed6443c49929fe2c1b8a46447c7-0000000000000001-000511cfb0d62522.journal
> #  journalctl -F _BOOT_ID | wc -l
> 160
> # journalctl --list-boots | wc -l
> 106
>
>
> Even after moving away the file
> system at 00050e650144ab12-15158e9a9df4f071.journal~ which caused the
> "unused data" message, I get
>
> # journalctl --list-boots | wc -l
> 101
> #  journalctl -F _BOOT_ID | wc -l
> 158
>
> 2015-03-27 21:23 GMT+01:00 Jan Janssen <medhefgo at web.de>:
>>
>>
>> On 2015-03-27 21:06, Michael Biebl wrote:
>>>
>>> 2015-03-27 20:45 GMT+01:00 Jan Janssen <medhefgo at web.de>:
>>>>
>>>> Martin Pitt <martin.pitt <at> ubuntu.com> writes:
>>>>
>>>>>
>>>>> Hello all,
>>>>>
>>>>> in [1] I just got a report that "journalctl --list-boots" (with
>>>>> persistant journal) only shows a few old boots, but not current ones.
>>>>> I checked this on my system (which has had persistant journal for a
>>>>> while), and confirm that:
>>>>
>>>>
>>>> What does "journalctl -F _BOOT_ID | wc -l" vs "journalctl --list-boots |
>>>> wc
>>>> -l" say?
>>>
>>>
>>> I can confirm the issue:
>>>
>>>
>>> # journalctl -F _BOOT_ID | wc -l
>>> 160
>>> # journalctl --list-boots | wc -l
>>> 106
>>>
>>>
>>> This is on an ext4, no separate /var partition.
>>>
>>>
>>
>> Well, the one reason I could think of right now is that there must be some
>> corrupted journals in there. Can you see if there are any using --verify and
>> then moving them out of the journal directory?
>>
>> journalctl -F vs journalctl --list-boots use different code paths while
>> digging through the journal. Afaik, one of them is stricter when it comes to
>> interleaving intact and corrupted journals.
>>
>> Jan
>
>
>