Why not just upload `/var/log/journal`? Or otherwise all of it?

[euank]

Right now, part of the journal is collected, but not all of it, and it's collected in a lossy exported format.

There are two options to make it less lossy, and both are still fairly usable.

If the entire /var/log/journal directory is uploaded, then the person who's analyzing the mayday archive can use journalctl --dir exported/var/log/journal and then add their own filters (e.g. -u docker) and so on.

The other option is to use the --output=export format option. If mayday runs journalctl -a -m --output=export and provides the output from that, the person analyzing it can then load it in and work with it. In theory anyways, in reality the journald-journal-remote command is picky so it's a little tricky to do, but nothing linux containers can't help.