[systemd-devel] systemd-journald missing crash logs

[Lennart Poettering]

On Fr, 12.01.18 16:13, Farzad Panahi (farzad.panahi at gmail.com) wrote:

> I am running Arch-ARM on RPi3. I have noticed when system crashes I cannot
> find any related crash log in journal logs.

What specifically is a "crash" supposed to mean?

journald syncs to disk whenever a log message above LOG_ERR is
delivered. I am not sure what "crash" is supposed to mean, but are you
sure that at least one LOG_CRIT/LOG_ALERT/LOG_EMERG message is
delivered to userspace about that?

> > Since the syslog component of systemd, journald, does not flush its
> > logs to disk during normal operation, these logs will be gone when the
> > machine is shut down abnormally (power loss, kernel lock-ups, ...). In
> > the case of kernel lock-ups, it is pretty important to have some
> > kernel logs for debugging. Until journald gains a configuration option
> > for flushing kernel logs, rsyslog can be used in conjunction with
> > journald.

As mentioned above, we wil sync immediately when a
LOG_CRIT/LOG_ALERT/LOG_EMERG log message is seen. We'll also sync on
normal log messages with a delay of 5min at max:

https://github.com/systemd/systemd/blob/master/src/journal/journald-server.c#L1440

if you get get a hard kernel lockup for some reason then this all is
useless however, as userspace won't even get the opportunity to write
anything to disk then... And it doesn't matter if userspace runs
journald or rsyslog.

Anyway, no idea what "crash" is supposed to mean though...

Lennart

-- 
Lennart Poettering, Red Hat