systemdsystemd-journald

Incompatible flags (0x1c) error with systemd 237 journal files on systemd 244 & 245


Description:
I am experiencing an issue where journal files written by systemd 237 are not readable by systemd 244.5 & 245. When attempting to use journalctl to view the journals produced on the v237 system, I get error messages indicating "incompatible flags 0x1c" and "Protocol not supported". The flags correspond to archived, sealed, and read-only states configured in /etc/system/journald.conf and have not been modified from the defaults on the v237 system. Here is output showing the errors:

enter image description here

System Information:

Journald Configuration

enter image description here

Steps Taken:

Request:
From my understanding, journalctl should be backward compatible and support journal logs produced by earlier versions of systemd. I need assistance in understanding why these flags are set by systemd 237 and how to make the journal files readable by systemd 244.5 & 245.


Solution

  • The flags are KEYED_HASH | COMPACT | COMPRESS_ZSTD. Ubuntu 20.04 did not enable libzstd in their systemd packages (or if the 244.5 is your own build – you did not enable libzstd in your build) so its journalctl cannot support files that have COMPRESS_ZSTD set.

    Upgrade to 22.04LTS or later (the systemd 249.11 package has libzstd) or build your custom journalctl.