How to Monitor Logs with journalctl

journalctl is a command-line tool for querying and displaying messages from the journal, which is the central logging area of systemd on Linux systems. It is useful for monitoring logs and troubleshooting issues. This tutorial will guide you through using journalctl to monitor and manage your system logs effectively.

1. View the Complete System Log

To view all logs collected by systemd, run:

journalctl

This command displays logs for all services since the system was last booted.

2. Filtering Logs by Time

You can filter logs based on specific times. To view logs from the current boot, use:

journalctl -b

To view logs from a previous boot, specify the boot ID:

journalctl -b -1

3. Filtering Logs by Unit

To view logs for a specific service, use the following command, replacing your-service with the name of the service:

journalctl -u your-service

This command displays logs only for the specified service unit.

4. Monitoring Logs in Real-time

Use the -f option to follow logs in real-time, similar to tail -f:

journalctl -f

This will continuously display new log entries as they are added.

5. Filtering Logs by Priority

You can filter logs based on their priority level. For example, to view error messages, run:

journalctl -p err

Different severity levels include emerg, alert, crit, err, warn, notice, info, and debug.

6. Searching Logs

You can search through logs using a keyword search:

journalctl | grep 'search-term'

Replace 'search-term' with the relevant keyword you want to find in the logs.

7. Exporting Logs

If you need to export logs to a file, you can redirect output as follows:

journalctl > my_logs.txt

This command saves all logs into a text file named my_logs.txt.

8. Conclusion

By using journalctl, you have the power to monitor and manage system logs effectively. Understanding how to filter and search logs will greatly enhance your ability to troubleshoot and maintain your Linux systems. Explore the complete options available in journalctl by checking its manual page:

man journalctl

About the Author

Dorian Kane

Author

View All Posts