Linux System Logs
Jump to navigation
Jump to search
The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.
SystemV logging mechanics
These are systems that uses init. They log into flat files usually
- /var/log/messages
- /var/log/syslog
The file size is managed by Logrotate.
Systemd - logginng
Systemd systems have journald demon running that gather information from kernel and other sources into one binary file(s).
vi /etc/systemd/journald.conf SystemMaxUse #max journal file size, by default 10% of a file system but max 4Gb SystemKeepFree #how much space should be left free, default min free is 15% but min 4Gb Storage #persistent save to storage, volatile saves logs at /run/log/
man systemd.journal-fields #fields information # -x add explanatory text from a message catalogue # -e go to end of the logs/catalogue systemctl status systemd-journald journalctl #reads logs journalctl --vacuum-size=100M #shrink logs to 100M journalctl --vacuum-time=1month #keep last 1month worth logs journalctl --disk-usage journalctl --verify #checks integrity PASS: /run/log/journal/0f141dd26a334ab6be80141b91356675/system.journal journalctl -p err #filter log levels, eg: crit; long --priority= journalctl -b #show logs since startup journalctl -b -1 #logs from a previous day journalctl --list-boots #show boot up occurances journalctl --since "201705-10 12:00" journalctl --since yesterday --until now journalctl -u apache2.service --since yesterday --until now #show logs related only to a specific service journalctl $(which cntlm) #show a application log journalctl -k (--dmesg)#kernel log, use -b for previous sessions, -n kernel events only eg. modprob,dpms journalctl -b -p err --no-pager > journal.txt #export logs to flat text file journalctl -f #continuous logs tailing