How to view journalctl without rebooting system in RHEL 7/8?

We're having issues with a customer having RedHat 7 PC's shutdown intermittently.

One was just sent in for repair, and I'd like to check the journald output.

However, I've read the rebooting the system overwrites it.

How can I view this journal without rebooting the system? Do I need a bootable RedHat or Centos USB stick? If so, how to I create it? How would I then view the drive/file?

Solution 1:

If it was shut down already, you'll have no luck. By default, Journald on CentOS 7/8 is storing log data in RAM.

You can ensure Journald logs data in persistent mode, by simply creating /var/log/journal:

# create the directory
mkdir -p /var/log/journal
# ensure the write permissions
systemd-tmpfiles --create --prefix /var/log/journal
# ping the daemon that the directory is there
killall -USR1 systemd-journald

This however, applies to currently booted machine and further reboots will have the data retained.

Solution 2:

Typically the data is stored in the /var/log directory. To configure the logging details see:

https://www.freedesktop.org/software/systemd/man/journald.conf.html

Setting Storage=persistent will ensure the data is written to disk.

The following values can be used to control the size limits: SystemMaxUse=, SystemKeepFree=, SystemMaxFileSize=, SystemMaxFiles=, RuntimeMaxUse=, RuntimeKeepFree=, RuntimeMaxFileSize=, RuntimeMaxFiles=

Files can then be read searched using journalctl.