Sep 28, 2018

Linux: journalctl and systemd - better than /var/log/messages?

Nearly 8 years ago systemd was introduced on some Linux distribution (s. here). Last week i discovered some helpful commands, which i share with you.

If you want to take a look at kernel message (for example system boot), you command is
The new equivalent is
journalctl -k
Ok - not really amazing.
But all of you know the message
See "systemctl status nginx.service" and "journalctl -xe" for details.
You can run the "systemctl start/restart/stop" and in case of error open the logs with "journalctl -xe". I would recommend to open a seperate shell and run there
journdalctl -f
This is something like "tail -f" to the systemd-journal.
If you do a "systemctl restart network" the shell with journalcctl -f shows the DHCP waiting for a answer from the server and you know why its so slow. You especially know, that your fifth interface has DHCP enabled and there is no DHCP, which slows down every "systemctl restart network".

journalctl has some nice filters like
journalctl -p 0..4
This just shows the message with
  • "emerg" (0), 
  • "alert" (1), 
  • "crit" (2), 
  • "err" (3), 
  • "warning" (4), 
  • "notice" (5),
  • "info" (6), "debug" (7)
Or filter for something like network messages:
journalctl -u NetworkManager

And my favourite: Pipe your own log messages into the systemd-journal:
echo This is important | systemd-cat -t MightyJournal -p notice
Which result in this entry:
Sep 28 20:48:55 zerberus MightyJournal[28520]: This is important

No comments:

Post a Comment