sigh Debian 12, right?
Debian 12 “improved” (personally, I think it is horrible) the traditional logging mechanisms and is only using systemd’s journald.
Relevant commands are:
# Limit the time scope:
journalctl --since=2015-11-15 --until="2015-11-16 20:59:59"
# Only errors:
journalctl -b -p err
# Only kernel messages
journalctl -t kernel
# Messages from last boot
journalctl -b-1
# Show how many boot have been logged:
journalctl --list-boots
This is only a small selection of useful journalctl commands, but should give you a start.
But to make things even worse, many distributions chose to do only volatile logging, so nothing is saved and logs will not survive a reboot. This could look like:
$ journalctl -b-1
Specifying boot ID or boot offset has no effect, no persistent journal was found.
If this is the case try:
- Edit
/etc/systemd/journald.conf
and make sure it looks like:[Journal] Storage=persistent
- Run
sudo killall -USR1 systemd-journald
- Reboot and try again and above commands should work
- All edits and commands should be executed via
sudo
or as root
IMO systemd is so big and so complex that it still has various quirks and bugs. I’m not a particular fan of it, but YMMV.
Now, of course you need to provoke another crash before you get any logs.