Recent yocto images have somehow disabled persistent storage of journal files so that you can only look at the log for the current boot. (even though "Storage=persistent" in journald.conf)
They did this to prevent it from overrunning the rootfs partition.
A previous thread suggested creating a service to periodically backup the log to another file, but I think that's an imperfect solution because that file probably won't contain the crucial last few error entries. The system would be crashed at that point.
Does anyone know an easy way to temporarily make it persistent like before, or set it to save only two logs rather than one? I can't figure out how the persistence was disabled.
Now I see how it is made volatile. Even though Storage=persistent, and /var/log/journal exists, /var/log has been made into a symbolic link to subdirectory of /var/volatile, which is a tmpfs ramdisk mountpoint.
We truly apologize for the delay in our response. We already have some updates on this case, check our notes below:
The edison-image.bbappend file in meta-intel-iot-devkit/recipes-core/images is the place where the volatile log is set up. Specifically the line immediately following the comment "# Add volatile log".
You can comment out this line and rebuild the image.
If you want to use an existing image, then you should disable volatile logs by doing something like this:
1. Comment out the line for /var/volatile/log in /etc/tmpfiles.d/00-create-volatile.conf
2. rm /var/log (deletes the existing symlink to /var/volatile/log)
3. mkdir /var/log (creates a real directory to replace the symlink just deleted)
Then reboot and logs should be persistent.