Right now, part of the journal is collected, but not all of it, and it's collected in a lossy exported format.
There are two options to make it less lossy, and both are still fairly usable.
If the entire /var/log/journal directory is uploaded, then the person who's analyzing the mayday archive can use journalctl --dir exported/var/log/journal and then add their own filters (e.g. -u docker) and so on.
The other option is to use the --output=export format option.
If mayday runs journalctl -a -m --output=export and provides the output from that, the person analyzing it can then load it in and work with it. In theory anyways, in reality the journald-journal-remote command is picky so it's a little tricky to do, but nothing linux containers can't help.
Right now, part of the journal is collected, but not all of it, and it's collected in a lossy exported format.
There are two options to make it less lossy, and both are still fairly usable.
If the entire
/var/log/journaldirectory is uploaded, then the person who's analyzing the mayday archive can usejournalctl --dir exported/var/log/journaland then add their own filters (e.g.-u docker) and so on.The other option is to use the
--output=exportformat option. If mayday runsjournalctl -a -m --output=exportand provides the output from that, the person analyzing it can then load it in and work with it. In theory anyways, in reality thejournald-journal-remotecommand is picky so it's a little tricky to do, but nothing linux containers can't help.