Where is “journalctl” data stored?

Question

When I issue journalctl I get a massive log of all system services, but where is all this information stored?

Answer 1

From man systemd-journald:

FILES
       /etc/systemd/journald.conf
           Configure systemd-journald behavior. See journald.conf(5).

       /run/log/journal/machine-id/*.journal,
       /run/log/journal/machine-id/*.journal~,
       /var/log/journal/machine-id/*.journal,
       /var/log/journal/machine-id/*.journal~
           systemd-journald writes entries to files in
           /run/log/journal/machine-id/ or /var/log/journal/machine-id/ with
           the ".journal" suffix. If the daemon is stopped uncleanly, or if
           the files are found to be corrupted, they are renamed using the
           ".journal~" suffix, and systemd-journald starts writing to a new
           file.  /run is used when /var/log/journal is not available, or when
           Storage=volatile is set in the journald.conf(5) configuration file.

And as man journalctl says:

journalctl may be used to query the contents of the systemd(1) journal
as written by systemd-journald.service(8).

These logs are managed by the systemd-journald service, so a more appropriate term would be "journald logs".

Answer 2

Note, however that Ubuntu is not using persistent journald log file by default.

Only the volatile /run/log/journal/<machine-id>/*.journal[~] is kept until the next boot. Alll is lost at each reboot.

You may see a list of boot retained in the log with

journalctl --list-boot

The logs are still kept in text file under /var/log; unless you have activated the use of persitent journald log by creating /var/log/journal directory