Raspbian: journalctl only lists current boot although syslogs exist

Question

Although there are previous syslog files in /var/log

-rw-r-----  1 root adm    55117 Feb 10 06:25 syslog.6.gz
-rw-r-----  1 root adm    66363 Feb 11 06:25 syslog.5.gz
-rw-r-----  1 root adm    54885 Feb 12 06:25 syslog.4.gz
-rw-r-----  1 root adm    53587 Feb 13 06:25 syslog.3.gz
-rw-r-----  1 root adm    64067 Feb 14 06:25 syslog.2.gz
-rw-r-----  1 root adm   700315 Feb 15 06:25 syslog.1
-rw-r--r--  1 root root    7147 Feb 15 16:36 Xorg.0.log.old
-rw-r-----  1 root adm     2298 Feb 15 16:36 debug
-rw-r--r--  1 root root    4585 Feb 15 16:36 boot.log
drwx--x--x  2 root root    4096 Feb 15 16:36 lightdm
drwxr-xr-x  5 root root    4096 Feb 15 16:36 .
-rw-r--r--  1 root root    7080 Feb 15 16:36 Xorg.0.log
-rw-r-----  1 root adm     1826 Feb 15 16:36 user.log
-rw-rw-r--  1 root utmp  292292 Feb 15 16:36 lastlog
-rw-rw-r--  1 root utmp    5376 Feb 15 16:36 wtmp
-rw-r--r--  1 root root   10068 Feb 15 16:38 x11vnc.log
-rw-r-----  1 root adm    54159 Feb 15 16:56 messages
-rw-r-----  1 root adm    55902 Feb 15 16:56 kern.log
-rw-r-----  1 root adm   487302 Feb 15 16:59 syslog

I cannot access these via sudo journalctl. What is wrong here?

 $ sudo journalctl --boot=-1
Specifying boot ID has no effect, no persistent journal was found

$ sudo journalctl --list-boots
 0 0899d06fa564423fb8a2d13b51cf060d Sat 2020-02-15 16:36:20 CET\u2014Sat 2020-02-15 17:00:58 CET

$ sudo journalctl --verify
PASS: /run/log/journal/981fbb89fa5946ffa631a5ab3514c88c/system.journal                                 

Answer 1

systemd has its own logging system within its journal. But for downstream compatibility the classic logging with files in /var/log/ isn't disabled. So you have two different logging systems running. But it is known that the systemd journal occupies a lot of storage so the journal is only created in the non persistent directory /run/ that is located in the ram. You can find the files of the journal in /run/log/journal/. But with a reboot the ram is cleared of course. So you only have the journal since the last boot up.

If you like to have a persistent journal you can configure it with:

rpi ~$ sudo mkdir -p /var/log/journal
rpi ~$ sudo systemd-tmpfiles --create --prefix /var/log/journal

Some more details about managing the journal you can find at Accessing the system log on Raspbian. To save storage space you may consider to deinstall old style logging with:

rpi ~$ sudo apt --autoremove purge rsyslog

Answer 2

I cannot access these via sudo journalctl. What is wrong here?

Those aren't really journald files, they are (mostly) syslog files, which is a separate entity. They are compatible with one another¹ and currently Raspbian enables them both by default, syslog presumably for "legacy" backward compatibility while the journald adoption incubates. The syslog implementation used on Raspbian is rsyslog.

Note that some of the files are neither journald nor syslog controlled, eg., the Xorg log is written there directly by the Xorg server. /var/log is a canonical place for system services and other things to place their logs if they are not using syslog or (at least WRT logging) systemd.

---

1. More specifically, journald supplants traditional syslog, but a syslog implementation can be hooked into journald, effectively creating two different output streams.