Log messages and journal logs Flashcards
Traditional logs location, for example rsyslog etc
/var/log
Man for systemd logs
man systemd-journald
Location of journalctl logs
Make journalctl logs written permanently
/run/log/journal
/var/log/journal
Config location of systemd-journald
/etc/systemd/journald.conf
Show last 10 lines of jounalctl
journalctl -n
Show last extended logs of jounalctl
journalctl -xe
- e- go to the end
- x- explanation
Show last 10 line with jouranlctl and continue listening
journalctl -f
-f -follow
Show logs for specific unit
journalctl -u httpd.service
Show logs of ring buffer
journalctl -k
dmesg
Location of configs related to log rotation
/etc/logrotate.d/file_name
Remote logging
Rsyslog is used for forwarding log messages in an IP network.
The main configuration file for rsyslog is /etc/rsyslog.conf. Here, you can specify global directives, modules, and rules that consist of filter and action parts.
__
vim /etc/rsyslog.d/my_file.conf
. @1.2.3.4:514 (send all logs from this pc to 1.2.3.4)
1.2.3.4 should be configured to accept requests on 514
@-udp
@@-tcp
Query to systemd journal
journalctl [opt] [match]
journalctl -f -o verbose (o=output: short, verbose,json etc)
journalctl -p err (p=priority: err, crit,alert,emerg, notice,warning)
journalct -u ssh (u=unit)
Query to systemd journal since/until
journalctl –since=yesterday –until=now
Info about how much time boot process took
systemd-analyze : shot info
systemd-analyze blame : long info
