[systemd-devel] Backup the current boot logs in raw format

[Zbigniew Jędrzejewski-Szmek]

On Thu, Aug 01, 2019 at 10:52:07AM +0200, Francis Moreau wrote:
> On Thu, Aug 1, 2019 at 10:36 AM Zbigniew Jędrzejewski-Szmek
> <zbyszek at in.waw.pl> wrote:
> >
> > On Thu, Aug 01, 2019 at 10:26:50AM +0200, Francis Moreau wrote:
> > > On Thu, Aug 1, 2019 at 9:45 AM Zbigniew Jędrzejewski-Szmek
> > > <zbyszek at in.waw.pl> wrote:
> > > >
> > > > On Thu, Aug 01, 2019 at 09:11:19AM +0200, Francis Moreau wrote:
> > > > > On Wed, Jul 24, 2019 at 4:08 PM Zbigniew Jędrzejewski-Szmek
> > > > > <zbyszek at in.waw.pl> wrote:
> > > > > > you can export and write to a journal file with:
> > > > > >   journalctl -o export ... | /usr/lib/systemd/systemd-journal-remote -o /tmp/foo.journal -
> > > > > > This has the advantage that you can apply any journalctl filter where
> > > > > > the dots are, e.g. '-b'.
> > > > >
> > > > > This doesn't look to work correctly:
> > > > >
> > > > > $ journalctl -b | head
> > > > > -- Logs begin at Thu 2017-04-13 14:05:51 CEST, end at Thu 2019-08-01
> > > > > 08:51:39 CEST. --
> > > > > Mar 25 06:51:35 crapovo kernel: microcode: microcode updated early to
> > > > > revision 0x25, date = 2018-04-02
> > > > >
> > > > > $ journalctl -o export -b | /usr/lib/systemd/systemd-journal-remote -o
> > > > > /tmp/foo.journal -
> > > > > $ journalctl -b --file=/tmp/foo.journal | head
> > > > > -- Logs begin at Sat 2019-06-22 18:32:31 CEST, end at Thu 2019-08-01
> > > > > 08:45:45 CEST. --
> > > > > Jun 22 18:32:31 crapovo polkitd[1278]: Unregistered Authentication
> > > > > Agent for unix-process:7300:772806437 (system bus name :1.4562, object
> > > > > path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale
> > > > > en_US.UTF-8) (disconnected from bus)
> > > > >
> > > > > As you can see, the start is not the same.
> > > > >
> > > > > Also are foo.journal data compressed ?
> > > >
> > > > What does "ls /tmp/foo*" say?
> > > >
> > >
> > > /tmp/foo at 4e9f5da4aaac4433bc8744fe49e25b5a-0000000000000001-000584e4cc1ef61f.journal
> > >  /tmp/foo.journal
> >
> > systemd-journal-remote will "rotate" files when they grow above certain size.
> > (The same as systemd-journald). 'journalctl --file=/tmp/foo*.journal' should
> > do the trick.
> 
> Indeed that did the trick, thanks !
> 
> It's a bit counterintuitive because I asked the journal to be saved in
> /tmp/foo.journal only. Can this "rotation" be disabled somehow ?

Unfortunately not. That's because of the heritage of those programs which
were written in mind with continuous reception of logs in mind, and
"conversions" like the one above were just a fortunate side-effect.
I guess it'd be nice to make it possible to disable rotation.

Zbyszek