6

journalctl -u ssh prints all records associated with the ssh unit. But how can I get all records not associated with the ssh unit? Things that don't work: journalctl -u '!ssh'; journalctl '!_SYSTEMD_UNIT=ssh'; journalctl '_SYSTEMD_UNIT!=ssh'. Documentation doesn't suggest that this is possible, but I'm still hopeful. ;-)

Improve this question
4
  • 1
    What's wrong with grep -v sshd? Or more refined, grep -v "$(hostname) sshd\[".
    – berndbausch
    Commented Feb 15, 2021 at 20:12
  • That's similar to what I'm doing currently, but I'd prefer a solution that's independent of the journalctl output format. My current kludge is: journalctl -f | awk '$5 !~ /sshd\[[0-9]+\]:/ { print }'.
    – smammy
    Commented Feb 16, 2021 at 21:04
  • @berndbausch because that kill journalctl as the standard way to extract logs from one side to another. most opentelemetry "hacks" use journalctl -o json... now if you have logs from the log ingestion you got an infinite loop.
    – gcb
    Commented Aug 13 at 5:33
  • @gcb You extract logs with journalctl, then post-process them with grep if the result is in text form, or whatever other tool is suitable e.g. jq for JSON.
    – berndbausch
    Commented Aug 15 at 2:10

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .