When a Debian system freezes, logs from the previous boot can help explain what happened. If the systemd journal is stored only in memory, those logs disappear after a restart. Persistent logging saves them to disk.
This guide applies to Debian systems running systemd, including servers, desktops, virtual machines, and Debian-based distributions such as Raspberry Pi OS that use systemd. It requires systemd-journald to be running and writable, persistent storage for /var/log/journal.
1. Check existing boot history
sudo journalctl --list-boots
Boot 0 is the current boot. Boot -1 is the previous recorded boot. If only 0 appears, older logs may not have been saved or may already have been removed.
2. Enable persistent logging
Create the storage directory and apply its system permissions:
sudo mkdir -p /var/log/journal
sudo systemd-tmpfiles --create --prefix /var/log/journal
Create a configuration override:
sudo mkdir -p /etc/systemd/journald.conf.d
sudo nano /etc/systemd/journald.conf.d/persistent.conf
Save this configuration:
[Journal]
Storage=persistent
SystemMaxUse=200M
Storage=persistent requests disk storage. SystemMaxUse=200M sets a storage budget of roughly 200 MB. Active journal files can temporarily take usage above this limit.
Apply the changes and move available in-memory logs to disk:
sudo systemctl restart systemd-journald
sudo journalctl --flush
This cannot recover logs already lost during earlier restarts.
3. Verify persistence
Inspect the main configuration and its overrides:
sudo systemd-analyze cat-config systemd/journald.conf
Check that the override appears and that no later setting changes Storage=persistent. Then check for journal files and current disk usage:
sudo ls -lh /var/log/journal/$(cat /etc/machine-id)/
sudo journalctl --disk-usage
You should see .journal files. To confirm retention across boots, perform a planned reboot when convenient:
sudo reboot
After reconnecting:
sudo journalctl --list-boots
sudo journalctl -b -1 -n 20 --no-pager
Seeing entries from the previous boot confirms that logs survived the reboot. If they do not, check that /var/log is writable and backed by persistent storage. Systems using RAM-backed logs or a temporary filesystem may need additional storage configuration.
4. Investigate a freeze after restarting
Start with the final 100 recorded messages from the previous boot:
sudo journalctl -b -1 -n 100 --no-pager
View previous-boot kernel messages and warnings or more severe messages:
sudo journalctl -k -b -1 --no-pager
sudo journalctl -b -1 -p warning --no-pager
Look for out-of-memory events, storage errors, watchdog reports, thermal problems, or service failures near the freeze. Keep the full log available because useful context may have a lower severity.
Export the previous boot for closer inspection or sharing:
sudo journalctl -b -1 --no-pager > previous-boot.log
Review the export for private information before sharing it. A hard freeze or sudden power loss can prevent the final messages from reaching disk, so an abrupt end without an error does not rule out a fault.
