4 ms·
Key issues for me were machine-id related and journal corruption. Also journalctl dumping core after a recovery-mode boot. That left us with no tools to deal wi
by hughrr 5y ago
Key issues for me were machine-id related and journal corruption. Also journalctl dumping core after a recovery-mode boot. That left us with no tools to deal with a compressed journal and no strace to find out what it was doing. I actually attached a USB disk to the machine and cp’ed the files off it in the end. This was inconvenient as the node was 1550 miles away from me.
- theamk 5y agoDid you use -D / --directory option to journalctl? It switches the tool from "do the common thing and inspect live system" mode to "do exactly what I want and just convert files in that directory to text". There is also "--file" option for one-file-at a time access, but it is harder to use. In particular, I have just verified with "strace" that running journalctl with either "-D /var/log/journal" or "--file" option does not even open machine-id file nor a d-bus socket -- so whatever problems you had with machine-id would be gone with. Also, when you said, that you "cp'ed the files off it", did you mean you copied off the contents of /var/log/journal? Were you able to open the files on the other machine?