# Verify journal persistence rather than assuming logs survive reboot

> The selected storage mode and writable storage determine where journald keeps records.

- Canonical URL: https://update.dsesecurity.com/updates/verify-journal-persistence-rather-than-assuming-logs-survive-reboot/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:15:30+00:00
- Modified: 2026-10-20T18:34:33+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

The selected storage mode and writable storage determine where journald keeps records.

## Potentially affected

Review local journald storage paths and size controls in the Debian trixie journald.conf manual.

## DSE recommendation

DSE recommends recording whether each server needs local records after reboot and how that requirement is met.

## Article

The selected storage mode and writable storage determine where journald keeps records.

## Source facts

The Debian journald.conf manual describes volatile storage under /run/log/journal and persistent storage under /var/log/journal, with early-boot or unwritable-disk fallback. Auto selects persistent behavior when the persistent directory exists and volatile behavior otherwise. The manual also provides separate runtime and system storage-size controls. Configuration alone therefore needs to be compared with the actual storage path.

Source: [Debian systemd manual — journald.conf(5) — systemd — Debian trixie — Debian Manpages](https://manpages.debian.org/trixie/systemd/journald.conf.5.en.html).

## Applicability

Review local journald storage paths and size controls in the Debian trixie journald.conf manual.

## DSE recommendation

DSE recommends recording whether each server needs local records after reboot and how that requirement is met. Inspect the effective mode, directory availability, free space, and any remote forwarding or archive. Do not treat a successful live log query as proof of persistence. Set retention and free-space expectations together, and monitor failures to write durable records. Keep early-boot evidence in the investigation plan because the transition to persistent storage is a distinct part of normal journal operation.

## Verification

On a nonproduction host, write a harmless identifiable event, inspect its storage context, and verify retrieval after an approved reboot. Review configured size controls and actual disk use. Confirm the retained record meets the operational requirement without claiming local persistence is a substitute for an independent log archive. Retain the effective configuration, actual journal path and pre-reboot event identity together. Ask the operations owner to approve the observed reboot persistence and the separate archive requirement before declaring logging coverage complete.

## Official reference

[Debian systemd manual — journald.conf(5) — systemd — Debian trixie — Debian Manpages](https://manpages.debian.org/trixie/systemd/journald.conf.5.en.html). Reviewed October 20, 2026.

## Primary reference

- Name: Debian systemd manual — journald.conf(5) — systemd — Debian trixie — Debian Manpages
- Authority: manpages.debian.org
- URL: https://manpages.debian.org/trixie/systemd/journald.conf.5.en.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Verify journal persistence rather than assuming logs survive reboot,” DSE Security, https://update.dsesecurity.com/updates/verify-journal-persistence-rather-than-assuming-logs-survive-reboot/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.