[Cialug] journelctl

[Jeffrey Ollie]

rsyslog may or may not have helped you depending on why the journal entries
went missing. If the disk that logs are stored on filled up, or filesystem
corruption made the log files disappear rsyslog wouldn't have helped.
Really, the only thing that guarantees that logs are saved in the case of
problems like that is streaming the logs in real time to another system.
Things like graylog, elasticsearch/logstash, and Splunk are helpful here,
but they can be resource intensive to run.

On Sun, Sep 18, 2016 at 9:22 AM, L. V. Lammert <lvl at omnitec.net> wrote:

> I can grok the benevits of journelctl, but found an interesting problem
> this AM - one of our servers shutdown for some reason overnight, and after
> restarting I went to journelctl to look at the logs.
>
> Imagine my surprise when there are two weeks of log entries MISSING before
> the restart!
>
> Has anyone seen an issue like this? Is there a way to recover the missing
> entries or must one install rsyslogd (or equivalent)?
>
>         TIA!
>
>         Lee
> _______________________________________________
> Cialug mailing list
> Cialug at cialug.org
> http://cialug.org/mailman/listinfo/cialug
>



-- 
Jeff Ollie
The majestik møøse is one of the mäni interesting furry animals in Sweden.