[systemd-devel] Backup the current boot logs in raw format

[Zbigniew Jędrzejewski-Szmek]

On Wed, Jul 24, 2019 at 03:48:40PM +0200, Francis Moreau wrote:
> Hi,
> 
> I would like to backup the journal logs for the current boot in a
> "raw" format so I can reuse it later with "journalctl
> --file=my-backup".
> 
> But looking at the different values for "-o" option I can't find the answer.
> 
> Could anybody give me some clues ?

One option is to simply copy some of the files in /var/log/journal
to a different location. You can then read them with 'journalctl -D'.
If you want to be more granular and only select specific log entries,
you can export and write to a journal file with:
  journalctl -o export ... | /usr/lib/systemd/systemd-journal-remote -o /tmp/foo.journal -
This has the advantage that you can apply any journalctl filter where
the dots are, e.g. '-b'.

Zbyszek