Servers – Ensure Journald Storage is Configured to Persistent Disk

Support > Fixing Checks > Server

06 March, 2026

This check ensures that journald is configured to store logs persistently on disk.

If logs are stored in volatile memory, they are lost after reboot, making troubleshooting and forensic analysis difficult.

Check Details

Resource: Server
Check: Ensure journald logs are written to persistent disk
Risk: Logs stored in memory are lost after reboot, preventing proper audit and forensic investigation.

Open a terminal session with root or sudo privileges.
Verify current journald storage configuration:
```
grep -e Storage /etc/systemd/journald.conf
```
Ensure the value is set to persistent.
Edit the journald configuration file:
```
sudo nano /etc/systemd/journald.conf
```
Add or modify the following line:
```
Storage=persistent
```
Save the file and exit.
Restart journald service to apply changes:
```
sudo systemctl restart systemd-journald
```
Re-run the audit command to confirm configuration.
Perform regular audits to ensure logs are being stored persistently.