Solved: How do I fix the “No journal files were found” error in systemd

Key Takeaways

• The article explains how to fix the “No journal files were found” error when using journalctl to view user unit logs in systemd.
• The article provides three possible solutions: creating the /var/log/journal directory, changing the Storage option in /etc/systemd/journald.conf, or adding the user to the systemd-journal or adm group.
• The article also answers some FAQs about viewing the logs of user units with sudo or su, and changing the location of the journal log files.

Systemd is a system and service manager that is widely used in Linux distributions. It provides a way to manage various aspects of the system, such as services, timers, sockets, devices, and more. One of the features of systemd is the journal, which is a centralized logging system that collects and stores messages from the kernel, services, and other sources.

Problem

The journal can be accessed with the journalctl command, which allows you to view, filter, and export logs. However, sometimes you may encounter an error when trying to view the logs of a user unit, such as a service or a timer that runs under your user account. The error message is:

journalctl --user -u myservice
No journal files were found.

This error means that journalctl cannot find any log files for the user unit you specified. This can be frustrating and confusing, especially if you need to debug or monitor your user unit. In this article, we will explain why this error occurs and how to fix it.

Depending on the cause of the error, there are different ways to fix it. Here are some possible solutions:

Solution 1: Create the /var/log/journal directory

If the directory does not exist, systemd will store the journal logs in memory, which are not persistent and are lost after a reboot. To enable persistent logging, you need to create the directory and set the proper permissions:

sudo mkdir -p /var/log/journal
sudo systemd-tmpfiles --create --prefix /var/log/journal

This will create the directory and set the ownership to root:systemd-journal and the permissions to 2755, which means that the owner and the group can read and write, and others can only read. It will also set an access control list (ACL) that grants read permission to the adm group, which is typically used for system monitoring.

Solution 2: Change the Storage option in /etc/systemd/journald.conf

If the Storage option is set to volatile, systemd will store the journal logs in memory, regardless of whether the /var/log/journal directory exists or not. To change this behavior, you need to edit the /etc/systemd/journald.conf file and set the Storage option to one of the following values:

• auto: This is the default value, which means that systemd will store the journal logs on disk if the /var/log/journal directory exists, or in memory otherwise.
• persistent: This means that systemd will store the journal logs on disk, and create the /var/log/journal directory if it does not exist.
• none: This means that systemd will not store any journal logs, and drop all messages.

After changing the Storage option, you need to restart the systemd-journald service to apply the changes:

sudo systemctl restart systemd-journald

Solution 3: Add the user to the systemd-journal or adm group

If the user unit logs are stored on disk, but the user does not have permission to access them, you can add the user to the systemd-journal or adm group, which have read permission to the log files. To do this, you can use the usermod command:

sudo usermod -aG systemd-journal username

or

sudo usermod -aG adm username

where username is the name of the user you want to add to the group. You need to log out and log back in for the changes to take effect.

Frequently Asked Questions (FAQs)

Question: Why does “No journal files were found” error occur?

Answer: The error “No journal files were found” occurs when journalctl cannot find any log files for the user unit you specified. This can happen for several reasons, such as:

• The user unit does not generate any logs. This is unlikely, but possible, if the user unit is very quiet or does not use the standard output or error streams to log messages.
• The user unit logs are stored in memory and not on disk. By default, systemd stores the journal logs in a volatile location, such as /run/log/journal, which is cleared on every reboot. This means that the logs of user units that run before the /var file system is mounted are not persistent and are lost after a reboot. This can also happen if the Storage option in /etc/systemd/journald.conf is set to volatile, which forces all logs to be stored in memory.
• The user unit logs are stored on disk, but the user does not have permission to access them. By default, systemd stores the journal logs on disk in a persistent location, such as /var/log/journal, if the directory exists and has the proper permissions. However, the log files are owned by the root user and the systemd-journal group, and have strict permissions that prevent other users from reading them. This means that a regular user cannot access the logs of their own user units, unless they are a member of the systemd-journal group or have some other way to elevate their privileges.

Question: How can I view the logs of a user unit with sudo?

Answer: You can use the -M or –machine option of journalctl to specify the machine name of the user session you want to view. You can find the machine name with the loginctl command, which shows the active sessions on the system. For example, if the user session has the machine name seat0, you can use:

sudo journalctl -M seat0 --user -u myservice

to view the logs of the user unit myservice.

Question: How can I view the logs of a user unit with su?

Answer: You can use the -l or –login option of su to start a login shell as the user you want to switch to. This will preserve the environment variables and the user session of the original user. For example, if you want to switch to the user alice, you can use:

su -l alice

Then, you can use journalctl as usual to view the logs of the user unit.

Question: How can I change the location of the journal log files?

Answer: You can use the SystemdJournalPath environment variable to change the location of the journal log files. For example, if you want to store the log files in /home/journal, you can use:

export SystemdJournalPath=/home/journal

You need to restart the systemd-journald service for the changes to take effect.

Summary

In this article, we learned how to troubleshoot and fix the “No journal files were found” error when using journalctl to view user unit logs in systemd. We explained why this error occurs and how to fix it by creating the /var/log/journal directory, changing the Storage option in /etc/systemd/journald.conf, or adding the user to the systemd-journal or adm group. We also answered some frequently asked questions about viewing the logs of user units with sudo or su, and changing the location of the journal log files.

Disclaimer: The author is not responsible for the accuracy, completeness, or validity of the content. The article is for informational purposes only and does not constitute professional advice.