I’ve been looking around but haven’t found an explanation on how to access logs without booting the system in question, i.e. when booted to a USB stick and examining the system drive without running the system, i.e. while running a live system from USB, another OS on a dual-boot machine, or after putting the system drive in a USB dock on a different computer.
What I managed to figure out:
- In my case, the system partition uses BTRFS, in which case Manjaro gives
/var/log
its own subvolume. This means that if I mount the drive to, say/mnt/syspart/
, the logs are not at/mnt/syspart/var/log/
(which is just an empty mountpoint for the subvolume), but at/mnt/syspart/@log/
- In the base dir of that subvolume, I see
Xorg.0.log
. - I can see a file
./journal/86584354b897c65a6654e6548f/system.journal
(that gibberish part is made up by me, but it looks like a very long hex number). Right next to it, there’s also a fileuser-100.journal
. - However, the
*.journal
files appear to be binary – how to I figure out what’s in them? Or are they not what they appear to be? - There’s also a directory called
timeshift
which I presume contains logs from snapshot operations, andcups
, which concerns itself with printer-related things.
In my particular case (trying not to hijack this thread for my troubleshooting, just to explain the scenario that got me here):
My computer has crashed (frozen for a second, then monitor turned off and machine stopped responding entirely, not even num lock worked), and not for the first time. I don’t want to accidentally make matters worse, and because I suspect a hardware issue with the SATA controller for drive containing the home dir, I try to avoid booting the system before I know more. The root partition lives on a separate SSD, and I can access it from a live system (using a Manjaro live image on a USB stick).
I can read the Xorg.0.log
alright, although its contents don’t help me much right now.
In my case, the `system.log’ file’s modification time is very close to the time the machine crashed, making it a “file of interest” to me – can anyone here tell me how to get to its contents, without booting the system?