journalctl Notes

-

Show logs since a specific time

journalctl --since yesterday
journalctl --since "1 hour ago"
journalctl --since "2020-09-03 12:34"

Show logs for a specific systemd unit

journalctl -u haproxy.service

Show logs for several units together

journalctl -u varnish.service -u hitch.service --since today

Show logs by executable

journalctl /usr/bin/bash

Display kernel messages

journalctl -k

Output journal entires as JSON

journalctl -b -u nobody -o json

or formatted JSON

journalctl -b -u nobody -o json-pretty

Supported output formats:

  • cat: Only the message field
  • export: Binary format for backup or transfer
  • json: One-line per entry standard JSON
  • json-pretty: Human readable JSON
  • json-sse: Server-sent event compatible JSON
  • short: Default syslog style output
  • short-iso: Default with ISO 8601 timestamps (YYYY-MM-DDTHH:mm:SS+TZ)
  • short-monotonic: Default with monotonic timestamps since boot ([ 1.817288])
  • short-precise: Default with microsecond precision timestamps (Aug 24 18:49:58.244998)
  • verbose: Include every available field in each journal entry

Show the n most recent entries (defaults to 10)

journalctl -n n

Follow logs

journalctl -f

Show current journal disk consumption

journalctl --disk-usage

Delete old journal entries

journalctl --vacuum-size=1G
journalctl --vacuum-time=1years

Comments

Post a Comment

Popular posts from this blog

SSH Private Keys - RSA vs. OpenSSH

-
It would seem that ssh-keygen on OS X Mojave generates OpenSSH Private Keys instead of the traditional RSA Private Keys. While on the surface this is not a problem at all, it recently created a problem for us in combination with our use of the net-ssh Ruby gem, specifically that only RSA Private Keys are supported by this particular version of the gem, unless other dependencies are explicitly installed. So there would appear to be two solutions to this problem. First, we could update the net-ssh gem or discover/install whatever other dependencies are required to support OpenSSH Private Keys. Option two is to convert the existing private key from OpenSSH to RSA. The man page for ssh-keygen is helpful, but not nearly clear enough for this use case, so I'm documenting it here because I'm sure it'll come back to bite me again in the future. Assuming ~/.ssh/id_rsa starts with: -----BEGIN OPENSSH PRIVATE KEY----- Run ssh-keygen -p -m PEM -f ~/.ssh/id_rsa and you will ...
Read more

tcgetattr: Inappropriate ioctl for device

-
Recently a colleague of mine was working on a bash script to copy a script to a group of servers, run the script and display the output. The basic structure of the script was: for host in $(host_list); do echo "Host = $host" scp -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no check_script.rb user@${host}:/tmp/check_script.rb ssh -tt -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no user@${host} 'chmod +x /tmp/check_script.rb' ssh -tt -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no user@${host} 'sudo ruby check_script.rb' done When he attempted to run his script, it was failing after copying the script to the first remote host with the error tcgetattr: Inappropriate ioctl for device .  A google search turned up a bunch of results, but nothing helpful enough to resolve the issue. The issue turns out to be the ssh command requesting a TTY and erroring out because it is unable to get one.  Removing the -tt option fro...
Read more

nstat dumping core

-
nstat is a tool for collecting linux network statistics. I use it in my monitoring stack to collect information about UDP data loss. The command maintains state, and on rare occasions, that state becomes corrupt. Corrupted state results in the command dumping core without any other explanation. $ nstat Aborted (core dumped) An strace of the command is similarly unhelpful. The best way I've found to rectify this situation is to reset the command's history nstat -r
Read more