Tenho um computador executando o Fedora Workstation 40 e o Systemd 255. Por algum motivo, as mensagens de log do kernel ficam disponíveis no Diário por muito menos tempo do que outras mensagens de log.
user@host:~ $ journalctl -k | head
Sep 07 22:15:28 host kernel: Linux version 6.10.6-200.fc40.x86_64 (mockbuild@f1069ead281040288cd8d3761ad1265a) (gcc (GCC) 14.2.1 20240801 (Red Hat 14.2.1-1), GNU ld version 2.41-37.fc40) #1 SMP PREEMPT_DYNAMIC Mon Aug 19 14:09:30 UTC 2024
Sep 07 22:15:28 host kernel: Command line: BOOT_IMAGE=(hd0,gpt2)/vmlinuz-6.10.6-200.fc40.x86_64 root=UUID=800307e3-abdf-4cc6-a111-b068a8bb22a9 ro rootflags=subvol=root rd.luks.uuid=luks-5da2f27b-d221-4a68-a150-648d03962ac0 rhgb quiet
Sep 07 22:15:28 host kernel: BIOS-provided physical RAM map:
Sep 07 22:15:28 host kernel: BIOS-e820: [mem 0x0000000000000000-0x0000000000057fff] usable
Sep 07 22:15:28 host kernel: BIOS-e820: [mem 0x0000000000058000-0x0000000000058fff] reserved
Sep 07 22:15:28 host kernel: BIOS-e820: [mem 0x0000000000059000-0x000000000009cfff] usable
Sep 07 22:15:28 host kernel: BIOS-e820: [mem 0x000000000009d000-0x00000000000fffff] reserved
Sep 07 22:15:28 host kernel: BIOS-e820: [mem 0x0000000000100000-0x000000003fffffff] usable
Sep 07 22:15:28 host kernel: BIOS-e820: [mem 0x0000000040000000-0x00000000403fffff] reserved
Sep 07 22:15:28 host kernel: BIOS-e820: [mem 0x0000000040400000-0x0000000075477fff] usable
user@host:~ $ journalctl | head
Aug 19 17:53:26 host systemd-journald[1079]: /var/log/journal/645eb9bfb5a942db9945b658805a08a5/user-1000.journal: Journal file uses a different sequence number ID, rotating.
Aug 19 17:53:26 host audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=user@42 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 19 17:53:26 host audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=user@1000 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 19 17:53:26 host audit[1718]: USER_START pid=1718 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_keyinit,pam_limits,pam_systemd,pam_unix,pam_umask acct="gdm" exe="/usr/libexec/gdm-session-worker" hostname=host addr=? terminal=/dev/tty1 res=success'
Aug 19 17:53:26 host audit[1675]: USER_START pid=1675 uid=0 auid=1000 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct="th" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
Aug 19 17:53:26 host audit[1675]: CRED_REFR pid=1675 uid=0 auid=1000 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_fprintd acct="th" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
Aug 19 17:53:26 host audit[1679]: USER_START pid=1679 uid=0 auid=1000 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct="th" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
Aug 19 17:53:26 host audit[1679]: CRED_REFR pid=1679 uid=0 auid=1000 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_fprintd acct="th" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
Aug 19 17:53:26 host audit[1799]: USER_ACCT pid=1799 uid=1000 auid=1000 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix acct="th" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success'
Aug 19 17:53:26 host audit[1799]: CRED_ACQ pid=1799 uid=1000 auid=1000 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_fprintd acct="th" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success'
Usar o comando journalctl com sudo não faz diferença. De acordo com journalctl --verifytodos os arquivos do Journal, eles estão OK.
A configuração do Journald está usando os valores padrão:
user@host:~ $ systemd-analyze cat-config systemd/journald.conf
# /usr/lib/systemd/journald.conf
[Journal]
#Storage=auto
#Compress=yes
#Seal=yes
#SplitMode=uid
#SyncIntervalSec=5m
#RateLimitIntervalSec=30s
#RateLimitBurst=10000
#SystemMaxUse=
#SystemKeepFree=
#SystemMaxFileSize=
#SystemMaxFiles=100
#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=
#RuntimeMaxFiles=100
#MaxRetentionSec=
#MaxFileSec=1month
#ForwardToSyslog=no
#ForwardToKMsg=no
#ForwardToConsole=no
#ForwardToWall=yes
#TTYPath=/dev/console
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#MaxLevelWall=emerg
#LineMax=48K
#ReadKMsg=yes
#Audit=yes
Há espaço livre suficiente em disco disponível:
user@host:~ $ du -hs /var/log/journal/
465M /var/log/journal/
user@host:~ $ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/dm-0 237G 23G 212G 10% /
devtmpfs 4.0M 0 4.0M 0% /dev
tmpfs 7.7G 14M 7.7G 1% /dev/shm
efivarfs 154K 55K 95K 37% /sys/firmware/efi/efivars
tmpfs 3.1G 2.2M 3.1G 1% /run
/dev/dm-0 237G 23G 212G 10% /home
/dev/nvme0n1p2 974M 353M 554M 39% /boot
tmpfs 7.7G 3.4M 7.7G 1% /tmp
/dev/nvme0n1p1 599M 20M 580M 4% /boot/efi
tmpfs 1.6G 72K 1.6G 1% /run/user/0
tmpfs 1.6G 228K 1.6G 1% /run/user/1000
O que pode estar causando isso e como fazer com que as mensagens do kernel permaneçam no Journal tanto tempo quanto outras mensagens?
-kpara journalctl implica-b -0, ou seja, ele mostra apenas informações da inicialização atual. As mensagens estão lá; só não são exibidas. Vejaman journalctlas informações de sobre como escolher os intervalos que você obtém exibidos.