No more boot logging since 16.04?

Question

I noticed that my /var/log/boot.log file has date 2016-04-22, last time I booted in 15.10. Where are Xenial boot.log files located?

Answer 1

Use journalctl

Since journald contains all the logs, you can use the journalctl command with suitable filters. In the case of boot.log, which used to contain messages from the init system, you could do:

journalctl -b0 SYSLOG_PID=1

• -b0 shows messages from the current boot, -b1 from the previous boot, and so on. Without the -b option, journalctl will show messages from the beginning of the log.
• SYSLOG_PID filters messages from PID 1, aka init.

Or:

journalctl -b0 --system _COMM=systemd

• _COMM=systemd looks for messages from the systemd command. Since systemd is init, this is the one we're interested in.
• --system filters messages from the system log instead of user session logs.

Example:

muru@muru-vm:~$ journalctl -b0 SYSLOG_PID=1
Apr 30 12:29:18 muru-vm systemd[1]: systemd 229 running in system mode. (+PA
Apr 30 12:29:18 muru-vm systemd[1]: Detected virtualization qemu.
Apr 30 12:29:18 muru-vm systemd[1]: Detected architecture x86-64.
Apr 30 12:29:18 muru-vm systemd[1]: Set hostname to <muru-vm>.
Apr 30 12:29:18 muru-vm systemd[1]: Initializing machine ID from random gene
Apr 30 12:29:18 muru-vm systemd[1]: Installed transient /etc/machine-id file
Apr 30 12:29:18 muru-vm systemd[1]: Set up automount Arbitrary Executable Fi
Apr 30 12:29:18 muru-vm systemd[1]: Listening on fsck to fsckd communication
Apr 30 12:29:18 muru-vm systemd[1]: Reached target User and Group Name Looku
Apr 30 12:29:18 muru-vm systemd[1]: Listening on udev Kernel Socket.
Apr 30 12:29:18 muru-vm systemd[1]: Started Forward Password Requests to Wal
Apr 30 12:29:18 muru-vm systemd[1]: Listening on /dev/initctl Compatibility 
Apr 30 12:29:18 muru-vm systemd[1]: Listening on Journal Socket.
Apr 30 12:29:18 muru-vm systemd[1]: Created slice User and Session Slice.
Apr 30 12:29:18 muru-vm systemd[1]: Created slice System Slice.
Apr 30 12:29:18 muru-vm systemd[1]: Starting Braille Device Support...
Apr 30 12:29:18 muru-vm systemd[1]: Mounting POSIX Message Queue File System
Apr 30 12:29:18 muru-vm systemd[1]: Mounting Debug File System...
Apr 30 12:29:18 muru-vm systemd[1]: Mounting Huge Pages File System...
Apr 30 12:29:18 muru-vm systemd[1]: Starting Load Kernel Modules...
Apr 30 12:29:18 muru-vm systemd[1]: Starting Uncomplicated firewall...
Apr 30 12:29:18 muru-vm systemd[1]: Starting Create list of required static 
lines 1-23

journalctl opens the logs in a pager by default, so you don't need to pipe to less.

---

Persistent logging

Ubuntu, by default, does not enable persistent journald logs. Thanks to the comment by @Auspex, you need to do either of:

1. Edit /etc/systemd/journald.conf to include:

   Storage=persistent
   

2. Create a /var/log/journal directory manually:

   mkdir /var/log/journal
   systemd-tmpfiles --create --prefix /var/log/journal
   systemctl restart systemd-journald
   

Related:

• How do I display log messages from previous boots under CentOS 7?

Answer 2

In Ubuntu 16.04 the boot.log file is still located in the /var/log folder as you can see here. The boot logfile is from today (2016-04-29). Maybe something went wrong when you installed Ubuntu 16.04 or have upgraded the operating system from Ubuntu 15.10 to Ubuntu 16.04 LTS.

Alternatively you can examine the general boot behavior from the comprehensive kern.log file. Another possible alternative would be to manually configure the syslog daemon to generate the boot log file and here is a tutorial how exactly to do this : How To View and Configure Linux Logs

Additional information :

I investigated the boot logging behavior on two different machines. On a computer with an UEFI based BIOS the boot.log file exists - but on a computer with legacy based BIOS it seems to not exist at all. So in case the system is installed in legacy BIOS (MBR/msdos) mode, this could be the explanation why your boot.log file is dated from 2016-04-22, it's a leftover from Ubuntu 15.10.

Updated information 2016-05-02 :

I kept on investigating the behavior of the boot logging file and observed that the boot.log file still exists on the UEFI based machine, but since a few days the file is empty. Another alternative I tried to see what happens during the boot process, was to install BootChart, but bootchart.png did not exist in the /var/log folder as expected after rebooting the system ... there only was an empty /var/log/bootchart folder which also did not contain the expected bootchart.png file.

Updated information 2016-05-04 :

Today the boot.log file seemed to have "functionality" again, it is filled with partial information from the boot process. It appears to be a randomly changing behavior, that I think can't be solved here on Ask Ubuntu - so you should consider to file a bug report on Launchpad to get this solved !

Conclusion - after one week of investigation of the boot.log file behavior in Ubuntu 16.04 : You shouldn't worry about /var/log/boot.log any longer and just get used to journalctl instead.

Answer 3

I was going through some bug reports and noticed in this one: https://bugs.launchpad.net/ubuntu/+source/ubuntu-gnome-default-settings/+bug/1536771 that Plymouth is actually writing to boot.log.

If you look at https://launchpadlibrarian.net/257898272/plymouth-debug.log and search in your browser for 'boot.log' you get the following lines:

[main.c:821] on_system_initialized:system now initialized, opening log 
[main.c:742] get_log_file_for_state:returning log file '/var/log/boot.log'
[main.c:805] prepare_logging:opening log '/var/log/boot.log'

I have no understanding of how the internals of Plymouth work, but since it is responsible for the splash screen that shows up before the login screen, I can only assume that if there is no splash screen (black screen) before getting to the login screen, the file is not modified. If you do have a splash screen showing before the login screen, the boot process output is redirected to the boot.log file.