19

I am trying to troubleshoot a system (Arch Linux) that had systemd installed.

The volume has been mounted on an Ubuntu system (14.04) that has no systemd installed.

How can I troubleshoot said systemd journal without switching the host box to systemd?

apt-get install journalctl does not work.

Zanna
  • 70,465
jottr
  • 765
  • Use a version of Linux that runs systemd such as Arch, Fedora, or Ubuntu 15.04 – Panther May 02 '15 at 13:02
  • You don't need to switch to systemd, just the journalctl binary is needed ... which unfortunately is not available for 14.04 (all PPAs for it seem to be defunct). Even 14.10 would do. – muru May 02 '15 at 13:03
  • @bodhi.zaen This would be the obvious solution but not it is currently not possible. – jottr May 02 '15 at 13:03
  • @muru so I gues it would be best to upgrade the host to a more recent ubuntu version. – jottr May 02 '15 at 13:04
  • 2
    A VM, or a LXC container might be simpler and safer. – muru May 02 '15 at 13:05
  • 2
    No. upgrading to 15.04 will not help: ubuntu's journalctl is not compatible with archlinux'journal file. Archlinux use lz4 compression while ubuntu use xz compression. So one can not read journal file from a system with journalctl from the other system. a simple chroot should be enough, no ? – solsTiCe May 02 '15 at 13:40
  • try using an archlinux live disk – wagyourtail Nov 16 '16 at 03:58
  • Since the systemd package is stored in git, you could git clone git://anonscm.debian.org/pkg-systemd/systemd.git and read the source, steal from it, or enter the adventure of trying to build systemd on 14.04 – waltinator Nov 19 '16 at 01:32
  • I'm just wondering, won't a chroot help with this? – daltonfury42 Dec 07 '16 at 07:32

2 Answers2

6

chroot into the Arch Linux system:

cd /location/of/arch/root
chroot /location/of/arch/root /bin/bash

journalctl looks for the journal files in /var/log/journal/machine-id/. If you boot up with a rescue OS that has a different machine ID or a different root it hence won't find any data there.

Hence,

a) use journalctl --directory=/var/log/journal/<machine-id>

b) or journalctl -m

The "-m" swicth merges the journals of all directories in /var/log/journal/*, hence makes it unnecessary to figure out the machine id of the host.

Source

daltonfury42
  • 5,499
-2

the command line partition recovery program called TestDisk should allow some manipulation to the systemd (Arch Linux) volume

this not not a full or "good" solution. but TestDisk can

  1. Rebuild a partition table, recover deleted partition
  2. Locate the ext2/ext3/ext4 Backup SuperBlock
  3. Copy files from deleted a ext2/ext3/ext4 partition.
  4. handle a non-partitioned volume
  5. Rewrite the Master boot record (MBR)

give it a try.

$ sudo apt-get install testdisk

start it

$ sudo testdisk

press Enter to create a new log & select the disk with the volume you want to manipulation

select the partition table type.
yours is Intel

from here you can

  • view files
  • Copy files

hope it helps

Community
  • 1
John
  • 1
  • 1
    More information on how to use TestDisk would be helpful in case the link breaks in the future. – George Udosen Dec 06 '16 at 00:27
  • @George is this what you wanted? – John Dec 06 '16 at 04:06
  • That's a good start but look at the bottom of the link you would see a section called documentation there you find a step by step link try that, but note that a down vote has been done on your answer so consider the question again before updating your post. – George Udosen Dec 06 '16 at 04:43