blob: 4da38c065a271d3fc9ccaf69959516a88fb6653e (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
<chapter xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-logging">
<title>Logging</title>
<para>
System-wide logging is provided by systemd’s
<emphasis>journal</emphasis>, which subsumes traditional logging
daemons such as syslogd and klogd. Log entries are kept in binary
files in <literal>/var/log/journal/</literal>. The command
<literal>journalctl</literal> allows you to see the contents of the
journal. For example,
</para>
<programlisting>
$ journalctl -b
</programlisting>
<para>
shows all journal entries since the last reboot. (The output of
<literal>journalctl</literal> is piped into <literal>less</literal>
by default.) You can use various options and match operators to
restrict output to messages of interest. For instance, to get all
messages from PostgreSQL:
</para>
<programlisting>
$ journalctl -u postgresql.service
-- Logs begin at Mon, 2013-01-07 13:28:01 CET, end at Tue, 2013-01-08 01:09:57 CET. --
...
Jan 07 15:44:14 hagbard postgres[2681]: [2-1] LOG: database system is shut down
-- Reboot --
Jan 07 15:45:10 hagbard postgres[2532]: [1-1] LOG: database system was shut down at 2013-01-07 15:44:14 CET
Jan 07 15:45:13 hagbard postgres[2500]: [1-1] LOG: database system is ready to accept connections
</programlisting>
<para>
Or to get all messages since the last reboot that have at least a
<quote>critical</quote> severity level:
</para>
<programlisting>
$ journalctl -b -p crit
Dec 17 21:08:06 mandark sudo[3673]: pam_unix(sudo:auth): auth could not identify password for [alice]
Dec 29 01:30:22 mandark kernel[6131]: [1053513.909444] CPU6: Core temperature above threshold, cpu clock throttled (total events = 1)
</programlisting>
<para>
The system journal is readable by root and by users in the
<literal>wheel</literal> and <literal>systemd-journal</literal>
groups. All users have a private journal that can be read using
<literal>journalctl</literal>.
</para>
</chapter>
|