Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [journald]

97 questions
50
votes
2 answers

How do view older journalctl logs (after a rotation maybe?)

I am running docker on ubuntu 16.04 and would like to view the logs. However, I am unable to view logs after what I am guessing is some sort of rotation or the logs grow to a certain size. I have not made any changes to my journald.conf, so I am…
jdf
  • 821
  • 1
  • 7
  • 9
39
votes
4 answers

How do you use systemd's journalctl patterns

I am trying to use journalctl's pattern matching on SYSLOG_IDENTIFIERS. As an example, I have a ton of message tagged sshd: $ journalctl -t sshd | wc -l 987 but if I try to use pattern matching to find them: $ journalctl -t 'ssh*' -- No Entries…
Mark Grimes
  • 584
  • 1
  • 5
  • 8
26
votes
1 answer

How to configure systemd journal-remote?

How to configure systemd journal-remote to listen on specific port? All I can find are command line examples. And base on man page, there don't seems to be any option in journal-remote.conf.
John Siu
  • 3,577
  • 2
  • 15
  • 23
17
votes
2 answers

journalctl access for non-root users

The journald documentation says that adding a user to 'systemd-journal' group or 'adm' group allows the user to access system-wide journal. I'm running the latest CentOS 7 and I seem to have problem accessing the journal as a non-root user. Here's…
mike
  • 221
  • 1
  • 4
  • 12
12
votes
1 answer

How to display syslog priority level in systemd's journalctl

journalctl allows me to filter on priority (-p) and color-codes the priority in the output. But is there any way to get it to output the priority directly, as text?
Avi Kivity
  • 223
  • 2
  • 6
11
votes
2 answers

journalctl - stop following without exiting pager

If I do: journalctl -u my-service then a Shift-F to follow while paging, how do I (interrupt to abort) without exiting the pager? With less, I typically just ^C, but if I do that in journalctl, it exits the entire pager.
MikeKusold
  • 231
  • 2
  • 5
9
votes
2 answers

Is rsyslog redundant on when using journald?

I have noticed log messages are duplicated in journald and /var/log/messages on my CentOS 7 system. At first I thought it was the journald option ForwardToSyslog (which defaults to 'yes' in the installed version) which caused this behavior, but…
joaerl
  • 317
  • 3
  • 9
9
votes
3 answers

Why are journald logfiles so huge?

When I do a journalctl --disk-usage it says something about 300MB size of the journal files but when I look at the actual text with journalctl | wc -c it's something about 28MB. Well, journald has compression and even considering the metadata like…
Smith_33
  • 93
  • 1
  • 4
7
votes
3 answers

systemd-journald Doesn't start at all

After deleting my /var/log/journal by accident, I am unable to recover from the consequences. systemd-journald keeps failing over and over again every time I try to start it. when I run: $ journalctl --verify PASS:…
lyoko the
  • 231
  • 1
  • 2
  • 6
7
votes
1 answer

How can I output logs to a file from the content of a service with systemd

Well, I have a service configured with systemctl. This is the config file: [Unit] Description=The description of the service (: After=network.target [Service] ExecStartPre=/bin/echo 'Starting Service' >>…
robe007
  • 203
  • 1
  • 2
  • 9
6
votes
1 answer

How to filter journalctl output by process name?

When a process logs to systemd, its process name is recorded and displayed as identifier in the journalctl output. $ systemd-cat echo "test" $ journalctl -f -- Logs begin at Sat 2018-02-24 12:13:24 CET. -- ... Jul 25 13:52:26 mycomputer echo[25098]:…
Merlijn Sebrechts
  • 369
  • 1
  • 4
  • 14
6
votes
3 answers

Logstash with journald instead of rsyslog

I'm used to sending my logs from a server to a remote Logstash using rsyslog, with a configuration file roughly as follows (usually more specific to prevent too many logs from being sent): *.* @192.168.5.5:5000 I'm now starting work on a server…
Loic Duros
  • 163
  • 1
  • 4
6
votes
1 answer

Getting journald to send email on certain events

I found these solutions for syslogd that send emails on certain events like local0.crit or local1.err How can I make syslogd email certain log messages to…
fdafgfdgfagfdagfdagfdagfdagfda
  • 171
  • 3
  • 14
5
votes
3 answers

System logs are empty (/var/log/messages; /var/log/secure; etc)

I found that rsyslog stopped writing on logs (messages; secure; cron;etc) System information: NAME="Red Hat Enterprise Linux Server" VERSION="7.4 (Maipo)" ID="rhel" ID_LIKE="fedora" VARIANT="Server" VARIANT_ID="server" VERSION_ID="7.4" already…
BANJOSA
  • 350
  • 1
  • 3
  • 15
5
votes
5 answers

reliable export of journalctl logs

I search a way for a reliable export of journalctl logs. I could use the --since=... option, but this is a bit fuzzy. In my case a script would call journalctl --output=json every ten minutes. I don't want to miss a single line and (if possible) I…
guettli
  • 3,113
  • 14
  • 59
  • 110
1
2 3 4 5 6 7