Comment by ajb

journald also logs to /run/log/journal/ (a tmpfs) so until reboot you can still extract logs from it even if it didn't manage to write them to disk. See the 'storage' option in `man journald.conf`