From the course: LPIC-1 Exam 102 (Version 5.0) Cert Prep

Unlock the full course today

Join today to access over 22,600 courses taught by industry experts or purchase this course individually.

Retrieve systemd journal data from a rescue system

Retrieve systemd journal data from a rescue system - Linux Tutorial

From the course: LPIC-1 Exam 102 (Version 5.0) Cert Prep

Start my 1-month free trial

Retrieve systemd journal data from a rescue system

“

- [Instructor] There are times where a server does crash we need to read the data from our recovered drive. For normal logging with our syslog or other equivalents, it's easy. We just mount the recovered drive into our file system and use grep to find what we want. This works because the syslog's messages are text files. However, the systemd-journald is binary so we can't do this. In order for us to access journals from a recovered system, they need be persistent. You make your journal persistent by creating a /var/log/journal directory. After restarting the system D dash journal D service, it creates a directory in /var/log/journal named with the UID or universally Unique Identification Number. This is different for your system. When you use journalctl it automatically reads the journal at /var/log/journal. And then, a directory named with your UID. Inside that directory, can be one or more journals depending on…

Contents