The Missing History
In Ubuntu, like most Linux distributions, system and application logs are critical for troubleshooting errors, auditing security events, and monitoring system health over time. However, to prevent these text-based log files from growing infinitely and consuming all your hard drive space, Ubuntu utilizes a background utility called `logrotate` (and `journald` for systemd logs). These utilities automatically compress, archive, and eventually delete old log files on a regular schedule (usually daily or weekly). If you are attempting to investigate a system crash or a security breach that occurred several weeks ago, you might find that the relevant logs have been automatically archived, rotated out, and permanently deleted by the system.
Configuring Logrotate to Keep Files Indefinitely
To stop Ubuntu from automatically archiving and deleting your crucial system logs, you must modify the configuration files governing the log rotation daemon.
Open your terminal (`Ctrl + Alt + T`). The primary configuration file for legacy syslog files is located at `/etc/logrotate.conf`. Open it with root privileges using a text editor: sudo nano /etc/logrotate.conf. Look for the lines that dictate the rotation schedule and retention, typically `weekly` and `rotate 4` (which means keep 4 weeks of logs before deleting). To stop deletion, you can change `rotate 4` to a massive number like `rotate 9999`. Furthermore, to prevent compression (which makes logs harder to grep), ensure the `compress` line is commented out with a `#`. Save (Ctrl+O, Enter) and exit (Ctrl+X). For systemd journals, edit the journald config: sudo nano /etc/systemd/journald.conf. Uncomment the line `#SystemMaxUse=` and set it to a very large value (e.g., `SystemMaxUse=50G`) to ensure the journal retains a massive history before auto-purging old entries. Finally, restart the journal service: sudo systemctl restart systemd-journald.