JOURNAL files exist as 2 different types. Please find information about each of them below.
Type 1: Linux Journald Event Log
The systemd-journald service saves system and service events in binary journal files. These logs include kernel, boot, syslog, and service events. Journal files are typically stored in /run/log/journa...
The systemd-journald service saves system and service events in binary journal files. These logs include kernel, boot, syslog, and service events. Journal files are typically stored in /run/log/journal or /var/log/journal.
Use the journalctl command to view journal files. For example, to view a file: journalctl –file /path/to/journalfile.journal.
Systemd-journald does not use separate log files. It stores events in a binary format unreadable by text editors. Query the journal with journalctl. Show all messages with:
journalctl
View the last 10 messages with:
journalctl -n 10
View the last n messages with:
journalctl -n {number}
Output new messages as written with:
journalctl -f
Journald logs are not persistent. They are stored in RAM and lost on reboot. Linux allocates fixed RAM to avoid memory issues.
The journal indexes all logs for efficiency. However, logs can be made persistent by adding Storage=persistent to journald.conf and restarting the service.
Journald classifies messages by priority and facility per the Syslog protocol. For example:
systemd[1]: /var/mount: Directory not empty, mounting anyway
gcr-prompter[4997]: Gtk: GtkDialog mapped without transient parent
Systemd
Gnome Logs
4D Database Software