Enable Persistent Logging in systemd-journald on Linux

By default, many Linux hosts keep journal data in /run/log/journal, which is cleared when the system shuts down. Persistent logging writes the same events under /var/log/journal so you can read earlier boots with journalctl after a restart.

The steps below were run on vm1.lab.example. You do not need to reboot the node; restart systemd-journald after config changes and use journalctl --flush when runtime logs should move to disk.

Quick answer

Create a journald drop-in:

sudo mkdir -p /etc/systemd/journald.conf.d

Write Storage=persistent into a new drop-in file:

sudo tee /etc/systemd/journald.conf.d/persistent.conf <<'EOF'
[Journal]
Storage=persistent
EOF

Apply it by restarting journald:

sudo systemctl restart systemd-journald

Move any runtime logs into persistent storage:

sudo journalctl --flush

Verify on-disk journal files and recorded boots:

ls /var/log/journal/*/

Then confirm earlier boots are recorded:

journalctl --list-boots

If Storage=auto is already active, creating /var/log/journal with the correct permissions and running journalctl --flush is sufficient.

Use a drop-in under /etc/systemd/journald.conf.d/ instead of editing /usr/lib/systemd/journald.conf directly. Package updates overwrite vendor files.

Check whether journald is already persistent

Start by reading the effective configuration and looking for journal files on disk:

systemd-analyze cat-config systemd/journald.conf | grep -E '^Storage=|^#Storage='

Sample output on a host already set to persistent storage:

#Storage=auto
Storage=persistent

The commented #Storage=auto line comes from the vendor defaults in /usr/lib/systemd/journald.conf. The uncommented Storage=persistent line is the active setting, usually from a drop-in under /etc/systemd/journald.conf.d/.

Next, confirm journal files exist under /var/log/journal rather than only under /run/log/journal:

ls /var/log/journal/*/

Sample output (truncated):

system.journal
system@000000000002c83b-0006596982cc774f.journal
user-1000.journal

Binary .journal files under a machine-ID directory mean journald is writing to disk. If /var/log/journal is empty but /run/log/journal holds active files, logs are still volatile and will not survive the next shutdown.

Storage=auto vs Storage=persistent

The [Journal] section of journald.conf controls where systemd-journald keeps data. The four supported Storage= values behave as follows:

Most default installs ship with Storage=auto. Creating /var/log/journal with the correct ownership can enable on-disk logging without editing the config file, but journald still needs journalctl --flush to move active runtime data from /run/log/journal into /var/log/journal.

Setting Storage=persistent is clearer because the setting states the intent explicitly and journald creates /var/log/journal for you on restart.

Enable persistent logging with Storage=persistent

Create a drop-in file so package updates do not overwrite your change:

sudo mkdir -p /etc/systemd/journald.conf.d

Write the override with a here-document so the [Journal] header and Storage= line stay aligned:

sudo tee /etc/systemd/journald.conf.d/persistent.conf <<'EOF'
[Journal]
Storage=persistent
EOF

Confirm the drop-in is visible in the effective config:

systemd-analyze cat-config systemd/journald.conf | grep '^Storage='

Sample output:

Storage=persistent

Restart systemd-journald so journald reads the new setting. Red Hat documents this step for RHEL 9 and 10 after changing journald.conf:

sudo systemctl restart systemd-journald

Journald should come back active immediately:

systemctl is-active systemd-journald

Sample output:

active

Flush runtime journal data into persistent storage:

sudo journalctl --flush

journalctl --flush asks journald to move data from /run/log/journal into /var/log/journal when persistent storage is enabled. It returns when the flush completes.

Confirm on-disk files exist after restart and flush:

ls /var/log/journal/*/

Sample output (truncated):

system.journal
user-1000.journal

After restart, journald creates /var/log/journal with mode 2755 and group systemd-journal when the directory was missing.

Enable persistence with Storage=auto

When Storage=auto is the effective setting and /var/log/journal does not exist yet, journald keeps active data under /run/log/journal.

sudo mkdir -p /var/log/journal

Create the directory, then let systemd apply the expected ownership and mode:

sudo systemd-tmpfiles --create --prefix /var/log/journal

The directory should be owned by root:systemd-journal with mode 2755:

stat -c '%a %U:%G %n' /var/log/journal

Sample output:

2755 root:systemd-journal /var/log/journal

Creating the directory alone does not move existing runtime logs. Flush journald so it switches from volatile storage to /var/log/journal:

sudo journalctl --flush

List on-disk journal files once the flush finishes:

ls -l /var/log/journal/*/

Sample output:

-rw-r-----+ 1 root systemd-journal 8388608 Aug 21 17:30 system.journal

You do not need to reboot for this path. A Storage=persistent drop-in plus systemctl restart systemd-journald is still the clearer long-term setup on servers you manage directly.

Verify logs survive reboot

Persistent storage is working when you can read log lines from a previous boot. List recorded boots:

journalctl --list-boots

Sample output (truncated):

-1 9d4e7e19e5674973a6235b3622e30289 Fri 2026-08-21 11:14:35 IST Fri 2026-08-21 16:57:05 IST
  0 bbbe4ea74b0544ffa21f77c804d0a1f9 Fri 2026-08-21 14:21:27 IST Fri 2026-08-21 17:30:50 IST

Fetch the last few lines from the previous boot session:

journalctl -b -1 -n 3 --no-pager

Sample output:

Aug 21 16:57:05 vm1.lab.example systemd-shutdown[1]: Syncing filesystems and block devices.
Aug 21 16:57:05 vm1.lab.example systemd-shutdown[1]: Sending SIGTERM to remaining processes...
Aug 21 16:57:05 vm1.lab.example systemd-journald[920]: Journal stopped

Seeing shutdown messages from -b -1 confirms those events were stored on disk, not only in the runtime journal.

Troubleshooting

References

• systemd journald.conf man page
• systemd journalctl man page
• Red Hat — Viewing system log messages

Summary

Persistent systemd-journald logging keeps boot history on disk under /var/log/journal instead of in the volatile runtime tree under /run/log/journal. Check the effective setting with systemd-analyze cat-config systemd/journald.conf, then add a drop-in with Storage=persistent when you want an explicit, durable default.

After any journald.conf change, restart the service with systemctl restart systemd-journald. Run journalctl --flush when runtime logs in /run/log/journal should move into persistent storage — including after you create /var/log/journal under Storage=auto. Confirm persistence with journalctl --list-boots and journalctl -b -1.

For reading and filtering stored logs, keep the journalctl cheat sheet nearby when you investigate services or earlier boots.