journalctl

Short KT on journalctl in RHEL7

Transcript

1. Journalctl
2. Overview  systemd handles boot process and service management  Journal is a component of systemd  Journal is implemented with journald daemon  journalctl is a utility to access and manipulate the data held with the journal.
3. Usage  journalctl #shows all logs  journalctl --utc #shows logs in UTC time  journalctl –b #shows logs since last reboot
4. Usage  journalctl --list-boots #see all boots  journalctl -b -1 #see logs from previous reboot
5. Filter by time  --since and --until options  format is YYYY-MM-DD HH:MM:SS  can also use keywords like yesterday, today, tomorrow, now, 1 hour ago  journalctl --since "2017-02-09 12:00:00“ #displays logs since that time  journalctl --since "1 hour ago“ #displays logs for the past hour
6. Filter by unit  journalctl -u docker #shows logs relevant to docker app  journalctl -u docker –f #shows and follows the logs for docker app  journalctl -u docker -u glusterd #shows logs for the two apps
7. Filter by priority  journalctl -p err –b #show only error messages and above  0: emerg  1: alert  2: crit  3: err  4: warning  5: notice  6: info  7: debug
8. Configuration  /etc/systemd/journald.conf  Storage=persistent
9. Maintanance  journalctl --disk-usage #shows disc space used  journalctl --vacuum-size=3G #cleans up logs up tll specified size is met  journalctl --vacuum-time=1years #clean up logs older than specified time