On a host where journalctl shows nothing from before the last reboot, which change makes the journal persist across reboots?
LPIC-1 Exam 102-500, objective 108. Essential system services medium
Draft — not checked yet. This question was written from the published exam objectives and cites the clause it comes from, but nobody has yet read it against that clause and signed for it.
It is kept out of search results and out of mock exams until they have. Read the source below before you take the answer as settled.
The options
Not correct Set Storage=volatile in /etc/systemd/journald.conf.
Wrong, and the opposite. Storage=volatile forces the journal into /run/log/journal, which is a tmpfs and is discarded on every shutdown.
Not correct Add `journal /var/log/journal` to /etc/rsyslog.conf.
Wrong. rsyslog is a separate service with its own files; nothing in rsyslog.conf controls where journald stores its data, and that is not valid rsyslog syntax.
Not correct Run `journalctl --flush` once, which permanently reconfigures the storage location.
Wrong. --flush asks journald to move the entries currently held in /run/log/journal into /var/log/journal, and only does anything if that directory already exists. It is the one-off migration systemd-journal-flush.service performs at every boot, not a setting that changes where the journal is stored.
Correct Create the directory /var/log/journal, or set Storage=persistent in /etc/systemd/journald.conf, then restart systemd-journald.
Correct. With the default Storage=auto, journald writes persistently only when /var/log/journal exists; creating it is enough. Storage=persistent makes journald create the directory itself.
Why
journald's Storage= setting takes volatile (always /run/log/journal, lost at reboot), persistent (always /var/log/journal, created if missing), auto (the default: persistent if /var/log/journal exists, otherwise volatile) and none (drop everything). Because a persistent journal grows, journald caps it with SystemMaxUse= and friends, and `journalctl --disk-usage` and `journalctl --vacuum-size=500M` let you inspect and trim it by hand.
Where this comes from
- Cited
- LPI exam objective 108.2
- What it says
- Understand persistent and volatile journal storage under systemd-journald.
Practise this
Reading one question is not practice. The trainer will draw a set from objective 108 and space the ones you get wrong.