RPi: journal cut off, missing boot messages

While trying to trace down some udev issues on RPi (3), running LE 7.0.1, I noticed that all of the boot messages where missing in the journal - journalctl -a started way too late.

-- Logs begin at Mon 2016-06-20 23:13:32 CEST, end at Mon 2016-06-20 23:14:49 CEST. --
May 18 14:51:06 LibreELEC connmand[385]: ntp: time slew +2881345.749678 s
Jun 20 23:13:32 LibreELEC systemd[1]: Time has been changed

The full log is here: ZECJ

To me it looks like the following might have happened:
- systemd noticed that the day was way back (there's no RTC on RPi), so it set the current date to it's build date (May 18th). From dmesg:

[    2.545925] systemd[1]: System time before build time, advancing clock.

- journald started, collected boot messages etc
- correct date was received via ntp, journald noticed that, rotated the journal because it's now June 20th and in journal.conf there's #MaxFileSec=1month (default) and then discarded the journal because of MaxRetentionSec=1day (explicitly set in journal.conf)

It would be great if some systemd/journald expert could have a closer look into that, maybe I missed something, but it seems we can't trace issues via journalctl on builds older than a month...

so long,

Hias

Quote from nickr

Is what you are looking for in dmesg?

Not dmesg, but the system log (journal). I'm looking for error messages from systemd-udevd.

A user reported that his udev rule doesn't work as expected, so I told him to do a "journalctl -a | grep udev". When I posted that (on May 17th) it worked on my system and I could see error messages like this:

LibreELEC systemd-udevd[1584]: failed to execute '/this/is/a/wrong/path' '/this/is/a/wrong/path': No such file or directory

But when he reported back yesterday he wrote that "journalctl -a | grep udev" didn't have any effect LibreELEC and I could verify that on my system.

The same thing happens on Wetek Play BTW and I guess all systems without an RTC are affected. XSXT

This is really annoying because without the system/boot log it's next to impossiible to track down errors

I think it would be best to disable time based rotation in journal.conf and only have size limits (the journal.conf manpage also suggests to do that) because we can't rely on the system time being set correctly on boot.

so long,

Hias
[hr]
Did a quick test, MaxRetentionSec indeed seems to be the culprit. If it's commented out in journald.conf (i.e. stock systemd config, default to none/unset) the journal output is back to what it should be:
HBXd

so long,

Hias