System log files contain messages about the system, kernel, services, and applications. The journald logging daemon, which is part of systemd, records system messages in nonpersistent journal files in memory. The journald daemon forwards messages to the system logging daemon, rsyslog.

Files in /run are volatile, so the log data is lost after a reboot unless you create the /var/log/journal directory. The journalctl command can be used to query the journal logs.

For more information, see the journalctl(1) and systemd-journald.service(8) manual pages.