What you need to know
The selected storage mode and writable storage determine where journald keeps records.
Potentially affected
Review local journald storage paths and size controls in the Debian trixie journald.conf manual.
DSE recommendation
DSE recommends recording whether each server needs local records after reboot and how that requirement is met.
The selected storage mode and writable storage determine where journald keeps records.
Source facts
The Debian journald.conf manual describes volatile storage under /run/log/journal and persistent storage under /var/log/journal, with early-boot or unwritable-disk fallback. Auto selects persistent behavior when the persistent directory exists and volatile behavior otherwise. The manual also provides separate runtime and system storage-size controls. Configuration alone therefore needs to be compared with the actual storage path.
Source: Debian systemd manual — journald.conf(5) — systemd — Debian trixie — Debian Manpages.
Applicability
Review local journald storage paths and size controls in the Debian trixie journald.conf manual.
DSE recommendation
DSE recommends recording whether each server needs local records after reboot and how that requirement is met. Inspect the effective mode, directory availability, free space, and any remote forwarding or archive. Do not treat a successful live log query as proof of persistence. Set retention and free-space expectations together, and monitor failures to write durable records. Keep early-boot evidence in the investigation plan because the transition to persistent storage is a distinct part of normal journal operation.
Verification
On a nonproduction host, write a harmless identifiable event, inspect its storage context, and verify retrieval after an approved reboot. Review configured size controls and actual disk use. Confirm the retained record meets the operational requirement without claiming local persistence is a substitute for an independent log archive. Retain the effective configuration, actual journal path and pre-reboot event identity together. Ask the operations owner to approve the observed reboot persistence and the separate archive requirement before declaring logging coverage complete.
Official reference
Debian systemd manual — journald.conf(5) — systemd — Debian trixie — Debian Manpages. Reviewed October 20, 2026.
Review the official source
Debian systemd manual — journald.conf(5) — systemd — Debian trixie — Debian Manpages · Verified October 20, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE