What is the difference between persistent and volatile journal storage?
Volatile = journal kept in RAM under /run (wiped on reboot); persistent = written to disk under /var/log/journal (survives reboot).
The journal can live in two places, and the difference matters the moment a machine crashes: if storage is volatile, the very logs that would explain the crash are gone after the reboot.
| Mode | Location | Survives reboot? |
|---|---|---|
| Volatile | /run/log/journal (a tmpfs in RAM) |
No |
| Persistent | /var/log/journal (on disk) |
Yes |
The behaviour is set by Storage= in /etc/systemd/journald.conf:
volatile— RAM onlypersistent— always on disk (creates/var/log/journalif missing)auto(the common default) — persistent only if/var/log/journalalready exists, otherwise volatile
So the simplest way to "turn on" persistence under auto is just to create the directory. Explicitly:
# /etc/systemd/journald.conf
[Journal]
Storage=persistent
sudo systemctl restart systemd-journald
Space caps stop logs eating the disk: by default the journal uses at most ~10% of the filesystem (and leaves ~15% free). Tune with SystemMaxUse= (persistent) and RuntimeMaxUse= (volatile).
Tip: On any server you care about, enable persistent storage — otherwise post-mortem analysis after a crash is impossible.