19

For example:

┌─[10:50:38/hypership/root/~]
└─╼ journalctl -b
No journal files were found.
-- No entries --

┌─[10:50:46/hypership/root/~]
└─╼ journalctl --verify
No journal files were found.

/var/log is full of files though, and this was working before. Seems like an Arch Linux update may have caused this.

Any idea what the problem may be? What more info can I provide?

sourcejedi
  • 48,311
  • 17
  • 143
  • 296
trusktr
  • 4,035
  • 7
  • 29
  • 34
  • 1
    journalctl -k shows dmesg (kernel messages), you can get the same output by simple running the command "dmesg". To check if journalctl is working for non-kernel messages just type journalctl -b, if that doesn't give any logs then paste the output of systemctl status systemd-journald* – Hesham Ahmed Jun 07 '16 at 21:54
  • 1
    art thou root?? – Peter Turner Jun 08 '16 at 17:55
  • @HeshamAhmed Updated my output to show output from -b and --verify options. – trusktr Jun 08 '16 at 17:57
  • @PeterTurner Yeah, I'm root. – trusktr Jun 08 '16 at 17:57
  • journalctl doesn't read normal log files but journal files in /var/log/journal/ folder. Can you check this folder exists and has .journal files in it? If not you just have to restart journald service so it can recreate the whole thing. To restart journald run `systemctl restart systemd-journald.service` – Hesham Ahmed Jun 08 '16 at 18:02
  • @HeshamAhmed `systemctl status` shows systemd-journald.service was "active" while this was happening. Restarting the service seems to have fixed it. Let me see if other apps start logging again... – trusktr Jun 08 '16 at 19:34
  • 1
    You could also get this error message, if you query logs for a specific service, and just made a typo in the service name, as I just did. – bvdb Apr 19 '19 at 16:21

1 Answers1

23
  1. sudo -i if not already.
  2. Try running journalctl -b to see messages from the current boot.
  3. If you still get -- No entries --, run journalctl --verify.
  4. If you get No journal files were found, something is corrupted with the journal service itself. Run systemctl status systemd-journald*
  5. If the services are all "green" (active/running), something is borked with the log files in /var/log/journal/<hash>. Try running the following to recreate them:

systemctl restart systemd-journald.service

The previous command will restart journald with a new hash under /var/log/journal. Now if you run journalctl -b you should see messages about the service itself starting.

Unfortunately the files under /var/log/journal are not parseable so figuring out the initial problem may be difficult, but at least logs going forward will work again.

Tobias J
  • 331
  • 2
  • 5
  • 4
    after `systemctl restart systemd-journald.service` everything worked fine! – Andrew Arrow Apr 27 '21 at 14:41
  • 1
    `systemctl restart systemd-journald.service` worked perfectly. I had a fresh droplet created on DO which ships with `systemd 245` version (Ubuntu 18.04) but all journal entries were missing. – mr-karan Mar 01 '22 at 05:35
  • on `journalctl --verify` I got 1 failure, but magically after that it all started working just fine :) – RAM237 Apr 05 '22 at 11:11