analyze systemd journal of a crashed / dead system

user_9035357 0
Viewed 104

i resently upgraded a system. after reboot i was not able to login again. all users have been rejected with Login incorrect. systemd with journaling was running and writing error messages to file in /var/log/journal as usual.

i so booted a system from a revovery usb stick (same distribution) mounted the root device of the failed system /mnt and tried to analyze the logs with journalctl --root=/mnt/var/log/journal -xe. journalctl did not find journal files.

question: how can i read systemd journal content of a dead system using a recovery system?

have fun

systemd-journald systemd
1 Answers

I may be a bit late, but I stumbled upon this question and here is what I found:
journalctl logs are located in /var/log/journal/*
journalctl app can read foreign journal files with the following switches:

  • --file= followed by the *.journal file of your choice. This option may be used multiples times
  • --root= followed by the root directory of you choice, probably a mounted partition
  • --image= followed by a disk image,

files as argument, with the option --file

user_132954950
Related