So by default, the systemd journal is not persistent.
That's a good reason for that on RHEL 10.
And that is because RHEL 10 also has rsyslog.
And rsyslog is taking care of persistency.
So all messages that the journal is generating
are forwarded to the rsyslog service.
And rsyslog creates file in the varlog directory
that allow you to read what is going on.
So rsyslog offers all the filtering
you need to fine-tune log persistency.
But if desired, the systemd journal
can be made persistent as well.
And that happens to be one of the RHCSA exam objectives.
Systemd journal settings are in uselib systemdjournal.com.
In there, you will find the setting storage is auto.
And that setting ensures that persistent storage is
happening automatically after creating the directory
varlogjournal.
Other options are storage is persistent,
which will store journals in varlogjournal by default
without you having to create a directory,
or volatile, which stores journals
in temporary directory runlogjournal,
or none, which doesn't store it at all.
In journal.conf, default settings
apply to ensure that the journal can grow in an unlimited way.
Leave them for what they are.
They're not so very interesting.
So log rotation by default triggers monthly.
And no more than 10% of the file system size can be used.
And no more than 15% of the file system free size can be used.
So if you want to check the current settings,
use journalctl pipe grep minus e runtime journal system journal.
And that will tell you which settings are currently used.
Now, the thing that you need to know
is how to make the journal persistent.
Let me show you.
So first, I'd like to show you this journalctl pipe grep
minus e runtime journal pipe system journal.
And there you can see the current settings
that are used by the runtime journal.
So the extended regular expression behind grep
looking for either runtime journal or system journal.
So we only have a runtime journal.
And here we can see that it has the size of 8 megabytes
and all the other parameters.
Now, I would like to show you this grep storage in user lib
systemd journald.conf.
And there we can see storage is set to auto.
Then I'm going to use mkdir var log journal.
And next, I'm using systemctl restart systemd-journal-flush.
service.
That sounds a little bit surprising
because systemd is so good at picking up stuff on the fly
that if you don't restart the systemd-journal-flush service,
then you will need to restart your entire machine.
And otherwise, you don't have a persistent journal.
And now we can see that within var log journal,
the persistent journal has been created.
Hey, how about this regular expression?
Well, here we can see the settings
for the current systemd journal.
And that's how you make it persistent.
Make sure you remember that.