journalctl
systemdPackage: systemd
Reads the systemd journal, by unit (-u), by period (--since), by boot (-b), live (-f). It is where a service's output went when it writes to no file.
What its options do in the lessons
From the same glossary the lessons render under their commands, so the two cannot disagree.
journalctl -u- Shows only the messages from that unit.
journalctl -f- Follows the journal and prints new entries as they arrive.
journalctl -n- Limits output to that many of the most recent entries.
journalctl -e- Jumps straight to the end of the journal.
journalctl -b- Limits to one boot:
-bthe current one,-b -1the one before. journalctl -k- Shows kernel messages only (the equivalent of
dmesg). AppArmor denials land here, in the kernel’s log rather than in the affected service’s. journalctl --no-pager- Opens no interactive pager: output goes straight to standard output. Essential in a script, where a pager would wait for a keypress nobody makes and hang the run.
journalctl --list-boots- Lists the recorded boots, which is where the identifiers for
-bcome from. journalctl --since- Shows only entries from a date or expression onwards (
--since '-2 hours'). journalctl --until- The upper bound, mirroring
--since. journalctl -p- Filters by syslog priority (
-p err: errors and worse). journalctl -x- Adds an explanatory note from the systemd catalogue under certain messages, saying what the event means and what can be done about it.
journalctl -o- The output format.
-o verboseshows every journal field, including the ones the normal format hides;-o catshows the message alone. journalctl --utc- Prints timestamps in Coordinated Universal Time. What you want in order to line the journal up against a source already writing in UTC, with no conversion done in your head.
journalctl -t- Filters on a program’s syslog identifier, useful for a tool with no unit of its own (
-t sudo). journalctl --disk-usage- Reports how much disk the journal occupies.
journalctl --vacuum-size- Deletes the oldest archived files until the journal fits the given size.
journalctl --vacuum-time- Deletes archives older than the given age.
journalctl --flush- Asks the daemon to flush the journal from
/run/log/journalinto/var/log/journal, once persistent storage exists. The option belongs tojournalctl, not to the daemon:systemd-journaldis not invoked by hand.
Lessons that teach it
- Reading logs with journalctlManaging services with systemd
- Configuration and secrets a unit can readManaging services with systemd
- Changing a packaged unit without losing your changeManaging services with systemd
- Restart policies, and the crash loop they hideManaging services with systemd
- sudo, and why nobody works as rootUsers, sudo and SSH access
- Reverse proxying a Node applicationHosting a web application with Nginx
- Reading the error log: why the 502 happenedHosting a web application with Nginx
- The limits that refuse: 413 and 504Hosting a web application with Nginx
- Creating a site, then putting a Node.js application on itISPConfig: hosting several sites on one server
- Scheduling a task: cron or a systemd timerBash scripting for administrators
- A script you can run twiceBash scripting for administrators
- fail2ban: banning repeated attemptsFirewall and hardening
- AppArmor: the refusal permissions do not explainFirewall and hardening
- Hardening the SSH daemon without locking yourself outFirewall and hardening
- Controlling log growthMonitoring a server
- Getting the alert to a humanMonitoring a server
- Revealed is not caused: dating the fault rather than the symptomDiagnosing a failure: what each output proves
- Two logs that say 14:02: a timestamp is not a numberDiagnosing a failure: what each output proves
- Capture before you repair: the state a fix deletesDiagnosing a failure: what each output proves
- What the fix proved, and what expired on its ownDiagnosing a failure: what each output proves
- A container with no memory limit, and the process the kernel kills insteadDocker: containers for hosting a Node application
- Verify before declaring success, and what a rollback does not undoDeploying: releases, the switch and rolling back
- shared_buffers and work_mem, without the folkloreAdministering PostgreSQL: access, connections and growth
- The release that breaks: roll back first, diagnose secondThe capstone: from repository to production
- The five proofs: demonstrate, do not assertThe capstone: from repository to production