Linux Server / Boot, systemd & Service Recovery
Investigate missing Linux logs after a reboot
A server can lose earlier boot evidence when the journal was volatile or retention removed it. Check actual retained boots and storage usage.
Environment and inputs: Linux server baseline · Ubuntu 24.04 LTS / RHEL 9-style systems. Use the specified distribution, init system and installed tool; service names, privileges and supported options can differ.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
journalctl --list-boots
journalctl --disk-usageRead the result
The commands show available boot records and journal disk accounting. They do not reconstruct records that were never persisted or already removed.
Resolve and verify
Compare journald storage configuration, filesystem availability and approved retention. Plan persistent or centralized collection and validate it across a controlled reboot.
Before changing production
Do not purge logs during the investigation or assume enabling persistence restores historical evidence.