A useful evidence question is whether a service produced records during a particular boot, whether journald retained them, and whether the acquisition includes the relevant journal files. “No matching message in this export” answers only the last part under the export's filters. It does not establish that a service never ran or that someone removed its history.
Identify the producing environment
Record the distribution, systemd package version, machine identity, relevant boot identifiers, service unit, and collection time. The upstream journald configuration manual explains volatile and persistent storage, configuration precedence, retention controls, and rate limiting. The live manual can describe a newer release than the examined host. Read that host's applicable vendor documentation and effective configuration; a commented setting in one file is insufficient when drop-ins or build defaults apply.
Persistent and runtime journal locations have different availability conditions. A disk image collected after a reboot need not contain journal material that existed only in runtime storage. Conversely, finding an older persistent file does not establish that all later messages used the same destination. Preserve directory context and available configuration as evidence of the collection conditions.
Keep the structured record
The upstream journal-field reference distinguishes timestamps, boot and machine identifiers, process information, and message fields. Keep native files when available, plus the parser version and export settings. Human-readable output can hide fields or transform time displays. Establish whether a field is attached by the journal service or supplied as message content before treating it as independent identity evidence.
Separate four kinds of gap
| Observed gap | Check before interpreting it |
|---|---|
| No record for one service | Service identity, relevant namespace, filters, and alternate logging destination. |
| Missing earlier boots | Runtime storage, available journal files, and retention boundaries. |
| Short missing interval | Restart, overload, rate-limit reporting, and producer health. |
| Endpoint and server disagree | Forwarding path, receipt times, export scope, and independent retention. |
Write these as hypotheses to check, not explanations already proved. A service that logs directly to an application file may have little useful journal content. A central platform may retain a message missing locally, but it can also omit fields or normalize its representation. Preserve the relationship between the two versions.
Build a discriminating comparison
Select a small interval around the question. Compare adjacent boots, service lifecycle records, application files, and an independent server transaction where available. Note whether the same collection method finds expected routine records outside the disputed interval. A filter that excludes known relevant events needs correction before its empty result carries weight.
Report the observed boundaries: which boots and files were collected, which unit and fields were searched, and which uncertainty remains. A bounded statement might be “No matching service records were located in the acquired persistent journals for boot B; runtime journals were unavailable.”