Keep system logs when a proper shutdown fails
Keep system logs when a proper shutdown fails
In Linux there are numerous logs, but not every one is kept in RAM. When you shut down your PC while powering off, the system may lose current logs, and if it doesn't shut down correctly, those logs can be cleared during boot. To prevent this, you might want to set a kernel flag or modify the GRUB boot string so logs aren't removed after startup. P.S. So far I've only tried accessing these logs from a live USB or another machine to see how they're managed.
You want to retain specific logs. Live media stores logs in RAM and doesn’t persist them, so you’ll need alternative methods to capture them after shutdown.
Old boot files need to be kept using systemd-journald. Use journalctl --list-boots to see them. For crash analysis, kdump is a better option instead of journalctl --boot -1. If you want more details about system crashes, check the kdump documentation at https://wiki.archlinux.org/title/Kdump
If I am not mistaking, the only thing that should be lost is data that hasn't yet been committed, it's flushed to the actual log file in intervals, making a backup at the time of the commit. The logs are only deleted when they reach there configured limit, which can be configured in "/etc/systemd/journald.conf", https://www.freedesktop.org/software/sys....conf.html . If your losing them on boot, then either journald has been configured to live in ram or your experiencing corruption. It is also possible that we are not talking about the same logs, but I assume we are. For a quick test. I purposely crashed a server and forcefully restarted it (physically removed power while on). This is on a Arch Linux Server with the XFS Filesystem as root and default journald settings.