[systemd-devel] Journalctl reading incorrect file

[Lennart Poettering]

On Do, 28.01.21 17:42, John Lane (systemd at jelmail.com) wrote:

>
>
> > journalctl reads from both dirs, always. What makes you think it reads
> > from the wrong dir only?
> >
>
> when I do `journalctl` I only get output up to the switch-root:
>
>
> Jan 28 08:33:31 archlinux systemd[1]: Reached target Switch Root.
> Jan 28 08:33:31 archlinux systemd[1]: Starting Switch Root...
> Jan 28 08:33:31 archlinux systemd[1]: Switching root.
> Jan 28 08:33:31 archlinux audit: BPF prog-id=8 op=UNLOAD
> Jan 28 08:33:31 archlinux audit: BPF prog-id=7 op=UNLOAD
> Jan 28 08:33:31 archlinux audit: BPF prog-id=10 op=UNLOAD
> Jan 28 08:33:31 archlinux audit: BPF prog-id=9 op=UNLOAD
> Jan 28 08:33:31 archlinux systemd-journald[235]: Journal stopped
>
> If I use -D to select the newest subdir of /var/log/journal then
> I see live messages.
>
> So I think it's reading from /run and not from /var but I could of
> course be wrong. I'm just going on the fact that the "live" data is
> definitely on /var and the /run file ends with the output above.

Hmm, does "strace" show it opens the files in /var?

Is it possible you are playing some weird games with your machine ID
or boot ID?

journalctl by default only shows messages matching either the current machine ID
or the current boot ID. (the latter since the initrd will have a
different machine ID than the host)

Lennart

--
Lennart Poettering, Berlin