Lesson 1.73: Reading the journal across boots
The systemd journal keeps entries from several boots, each with its own boot ID, and can check its own files for corruption. After an unexpected reboot, the end of the previous boot often says why it happened, and the gaps say what someone didn't want recorded. In the lab you list the boots of the compromised Git server, read how the previous boot ended, look for the attacker's activity and its absence, verify the journal files, and find where an untouched copy of the logs lives.
18 min
You will learn to
- List boots with journalctl --list-boots
- Read a previous boot with -b -1
- Combine boot, identifier and time filters
- Check journal files with --verify
- Know where central copies help
Key terms
- Boot ID
- A random ID per boot; every journal entry carries it.
- -b -1
- Entries of the previous boot (0 is the current one).
- Persistent journal
- Stored in /var/log/journal; survives reboots. Without it, only the current boot is kept.
- journalctl --verify
- Checks journal files for consistency; PASS or FAIL per file.
- Log forwarding
- Sending each message to another server as it's written.
← Secrets in process memory and ptrace · All lessons · When eBPF is the hiding place →