service/prometheus.md

@@ -1369,6 +1369,14 @@ restrict the output the actual, individual alerts with:
 
     journalctl -u tpa_http_post_dump.service -o cat -f | jq .alerts
 
+Note that journald rotates those logs pretty aggressively: last we
+checked, we only had 24h of history. Work should be done to write
+those to syslog or an actual file to keep them longer (and make
+parsing easier).
+
+See [tpo/tpa/team#42222](https://gitlab.torproject.org/tpo/tpa/team/-/issues/42222) for improvements on retention and more
+lookup examples.
+
 ### Testing alerts
 
 Prometheus can run unit tests for your defined alerts. See [upstream unit test