Where Are systemd journald Logs Stored? journalctl Log Location Explained

systemd-journald stores its logs in /var/log/journal/<machine-id>/ when persistent storage is enabled, or in /run/log/journal/<machine-id>/ when storage is volatile (a tmpfs cleared on every reboot — the default when /var/log/journal doesn't exist). The files are binary *.journal files that you read with journalctl, never with cat or tail directly.

Quick Reference: journald Log Paths and Settings

The <machine-id> subdirectory matches the contents of /etc/machine-id, so paths look like /var/log/journal/9f8c.../system.journal.

How to View and Tail journald Logs

journalctl                      # all logs, oldest first
journalctl -e                   # jump to the end (most recent)
journalctl -f                   # follow live, like tail -f
journalctl -r                   # reverse: newest first
journalctl -n 100               # last 100 lines

# Scope by boot
journalctl -b                   # current boot
journalctl -b -1                # previous boot
journalctl --list-boots         # list available boots

# Scope by unit, priority, time
journalctl -u sshd              # one service
journalctl -u nginx --since today
journalctl -p err               # priority error and above (0-7 / emerg-debug)
journalctl --since "2026-06-01 09:00" --until "2026-06-01 10:00"
journalctl -k                   # kernel messages (dmesg equivalent)

# Output formats
journalctl -o json-pretty
journalctl -o cat               # message text only, no metadata

To read journal files from another machine (e.g. recovered from a dead server):

journalctl --file /mnt/recover/var/log/journal/<machine-id>/system.journal
journalctl --directory /mnt/recover/var/log/journal/<machine-id>/

Persistent vs. Volatile Storage

The behavior is controlled by Storage= in /etc/systemd/journald.conf:

• auto (default on most distros) — persistent only if /var/log/journal/ exists; otherwise volatile in /run/log/journal/.
• persistent — always write to /var/log/journal/, creating it if needed.
• volatile — always write to /run/log/journal/ (RAM); lost on reboot.
• none — keep nothing on disk (logs can still be forwarded to syslog or read live).

To switch a machine from volatile to persistent:

sudo mkdir -p /var/log/journal
sudo systemd-tmpfiles --create --prefix /var/log/journal
sudo systemctl restart systemd-journald

Or set it explicitly and restart:

# in /etc/systemd/journald.conf
[Journal]
Storage=persistent

sudo systemctl restart systemd-journald

Verify which mode is active:

journalctl --header | grep -i path     # shows the active journal file path

If the active file lives under /run/log/journal, you're volatile; under /var/log/journal, you're persistent.

Log Rotation and Disk Limits

journald does not use logrotate. It rotates and prunes its own files based on the limits in journald.conf:

Check and trim usage on demand:

journalctl --disk-usage                 # current total size
sudo journalctl --vacuum-size=500M       # keep at most 500 MB
sudo journalctl --vacuum-time=2weeks     # delete entries older than 2 weeks
sudo journalctl --vacuum-files=5         # keep at most 5 archived files

After editing limits, apply them with sudo systemctl restart systemd-journald.

Common Errors You'll Find in journald Logs

• Failed to start <unit>.service. — a unit failed; follow with journalctl -u <unit> -b for the root cause.
• Journal file /var/log/journal/.../system.journal corrupted, ignoring file. — a journal was truncated (often an unclean shutdown); journald rotates past it automatically but you lose those entries.
• Suspending input on /dev/kmsg... or Suppressed N messages from ... — rate limiting kicked in (RateLimitIntervalSec/RateLimitBurst); a noisy unit is flooding the journal.
• Time has been changed — the system clock jumped, which can scramble chronological ordering in journalctl output.
• No space left on device with journald failing to write — the filesystem holding /var/log/journal is full; vacuum the journal or lower SystemMaxUse.
• Permission denied from journalctl for a normal user — add the user to the systemd-journal group to read system logs without sudo.

Troubleshooting: Logs Missing or Empty

• Logs disappear after every reboot — You're in volatile mode. Create /var/log/journal and restart journald, or set Storage=persistent.
• journalctl shows "No journal files were found" — Either journald has written nothing yet (fresh boot, volatile mode) or your user lacks access. Try with sudo, and check systemctl status systemd-journald.
• journalctl -b -1 says "Specifying boot ID has no effect, no persistent journal was found" — Without persistent storage there is only the current boot. Enable persistence to retain previous boots.
• A service produces no journal entries — Confirm the unit actually writes to stdout/stderr (journald captures those). Services that daemonize and write only to their own file won't appear unless configured to log to the journal.
• Permission denied reading another user's journal — Per-user journals (user-<UID>.journal) are restricted; root or membership in systemd-journal is required to read across users.
• Disk usage keeps growing — SystemMaxUse may be unset or too high. Set an explicit cap and run journalctl --vacuum-size.