<html><head></head><body><div>I maintain a derivative of Fedora Live (built using lorax) that gets deployed on hundreds of systems, far more than my team has the man-power to keep a watchful eye. Occasionally we are notified of a problematic node and often it would be helpful to see the full journal for say, the first 15 minutes of run-time in which the node transforms itself from a generic appliance to a specific role. Unfortunately, in many cases we are notified too late and journald has tail-trimmed the logs we desire most.</div><div><br></div><div>Reviewing journald.conf(5) I don't see options to achieve what I want directly so my thought is to create a service and timer with OnBootSec=15m to duplicate the journal over to persistent storage, which would then require non-standard techniques for viewing but at least the availability would be guaranteed.</div><div><br></div><div>Is there a better way to achieve this? If not, what's the best way to duplicate the journal data? Simply cp -a /var/log/journal/ ... or use journalctl to dump or export it somehow?</div><div><br></div><div>I'll also add that I also wish to retain higher priority messages for a longer period, though for the first ~15m I want everything, DEBUG included. That leads me to think about a 2nd logger (journald, ideally) which had messages forwarded to it, but with different retention characteristics.</div></body></html>