What is the systemd journal stored?

Question

Options

• A/var/jlog/ and /var/jlogd/
• B/proc/log/ and /proc/klog/
• C/run/log/journal/ or /var/log/journal/
• D/var/log/syslog.bin or /var/log/syslog.jrn
• E/etc/systemd/journal/ or /usr/lib/systemd/journal/

• A
  2% (1)
• B
  2% (1)
• C
  78% (42)
• D
  13% (7)
• E
  6% (3)

Explanation

Option C is correct because systemd's journald daemon writes its binary log data to /run/log/journal/ (volatile, in RAM - lost on reboot) when no persistent storage is configured, and to /var/log/journal/ (persistent, on disk) when that directory exists. This two-location design lets admins choose between ephemeral and persistent logging simply by creating or removing /var/log/journal/.

The distractors are all fabricated paths: /var/jlog/ and /var/jlogd/ (A) don't exist in any standard Linux distribution; /proc/log/ and /proc/klog/ (B) confuse the kernel's virtual /proc filesystem with logging - /proc/kmsg exists for kernel messages but is not the journal; /var/log/syslog.bin and /var/log/syslog.jrn (D) are invented extensions that blend classic syslog naming with fake binary suffixes; /etc/systemd/journal/ and /usr/lib/systemd/journal/ (E) look plausible because those paths house configuration and unit files respectively, not the journal data itself.

Memory tip: Think RAM = /run/, Disk = /var/ - and both paths share the middle segment log/journal/, so if you remember "log/journal" you just need to pick the right prefix based on volatility.

No community discussion yet for this question.