WIUNIX ACADEMY
Investigate the previous Linux boot with journalctl
Page 2 of 2. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
LET’S BUILD
Save only the relevant interval, privately
From your private working directory, make a fresh file with a restrictive umask. If the read fails, the panel removes the partial file. An empty export is not evidence that nothing happened. Review and redact entries before sharing, and remove the export through your incident retention process when it is no longer needed.
Authorized terminal on the affected host
(
umask 077
evidence=$(mktemp ./previous-boot.XXXXXXXX) || exit 1
if journalctl -b "$boot_id" --since "$start" --until "$end" --utc --no-pager -o short-iso-precise > "$evidence"; then
wc -l -- "$evidence"
else
rm -- "$evidence"
exit 1
fi
)A new private file and its line count are printed. Confirm it has the expected messages before using it as evidence.
If the previous boot isn’t in the journal
Journal entries in volatile storage are normally lost across reboot. Persistent storage can still rotate older data, and with automatic storage the persistent directory must exist. Ask the host owner about retention and inspect the merged configuration before changing anything. Switching to persistent storage now cannot recover an earlier volatile journal.
The checks change no service or boot settings. If evidence is missing, consult approved central logs or provider/hypervisor events. For future incidents, agree separately on persistent storage and retention against the host's disk budget.
Only the current boot is listed
With approved privilege, inspect boot visibility, journal disk usage and the merged config. A persistent directory alone does not demonstrate that the previous boot survived.
sudo journalctl --list-boots --utc --no-pager
sudo journalctl --disk-usage
systemd-analyze cat-config systemd/journald.confGO TO THE SOURCE
Official references
Each environment states how it was reviewed. A documentation review does not claim a hands-on test of every version.
KEEP LEARNING