14

It could be because you are trying to review the journal since the last boot, which seems likely to be the case inside a docker image. On Ubuntu 16.04, the journal storage defaults to being in-memory. You can change the default to be persistent by opening /etc/systemd/journald.conf and changing the Storage= line from auto to persistent. You may need to ...


13

I'm not sure which timestamp makes the most sense but this works for me. Hopefully there is a better way of working with the timestamps from systemctl show than awk - could not figure out how to control the format of timestamps. unit=foo.service ts=$(systemctl show -p ActiveEnterTimestamp $unit) echo $ts ActiveEnterTimestamp=Fri 2016-11-11 12:30:01 MST ...


10

On older systemd versions, you'll have to use journalctl --user --user-unit=SERVICENAME (on newer versions journalctl --user -u SERVICENAME will work fine). However, this only works if the Storage directive of the [Journal] section of /etc/systemd/journald.conf is set to persistent (instead of auto or volatile). Reboot after editing the configuration file ...


8

Install ccze, then use it like this: journalctl -b -k -f | ccze [-A] [-o nolookups] explanation: -A, --raw-ansi If one wants to enable raw ANSI color sequences instead of using curses, this option does just that. -o, --options OPTIONS... However, lookups is an option that might be better to disable. When on, ccze will try to look up ...


7

You can install a syslog daemon such as rsyslog (the default on Red Hat derived systems). This will log all journal entries in a more backward compatible manner, and of course you can specify a custom log for whatever you wish. If you don't need logs exported in real time, you can use journalctl --since as some people have mentioned. You can run it daily at ...


7

The color support of journalctl is documented in man journalctl: When outputting to a tty, lines are colored according to priority: lines of level ERROR and higher are colored red; lines of level NOTICE and higher are highlighted; other lines are displayed normally. That's from systemd 229. As seen in the man page, There are no other built-in ...


6

After renaming the hostname, deleting & recreating /etc/machine-id by running systemd-machine-id-setup and rebooting to apply these, systemd-journald came back to life!


6

If the original daemon output is already colorized, but the colors are being lost when using journalctl, the --output cat option will restore them. See the manual for more details.


6

The solution is to change group ownership and add a sticky bit to the parent folder before the .journal files are created. chown :systemd-journal /var/log/journal/f9afeb75a5a382dce8269887a67fbf58 chmod g+s /var/log/journal/f9afeb75a5a382dce8269887a67fbf58


5

This is happening probably because of rate limiting in journalctl conf. Check RateLimitInterval and RateLimitBurst in /etc/systemd/journald.conf file.


4

You can use the boot flag to fetch only the logs from that boot. for instance journalctl _SYSTEMD_UNIT=avahi-daemon.service -b 5


3

Just figured this out. You can use any systemd journal field as filter by specifying <FIELD_NAME>=<VALUE>. The following fields are useful for this question: _COMM=, _EXE=, _CMDLINE= The name, the executable path, and the command line of the process the journal entry originates from. So in order to filter on the command name, use ...


3

You can use field filters with Journalctl. E.g. journalctl _PID=1234 Get a list of all the available fields using: journalctl --fields --unit kubelet One available field is _PID. You can get the PID of a running process using pidof or systemctl show --property MainPID <SERVICE_NAME> So here's how I get the logs from the current Kubernetes kubelet ...


3

just try setting timezone. # timedatectl set-timezone *your timezone*


3

These might help you: journalctl -u foo.service | tail -n 2 or replace 2 with expected number of lines journalctl -u foo.service --since='2016-04-11 13:00:00' You can as well combine them to get firstly the last run time timestamp, and then use that timestamp with the --since switch.


3

My question to journalctl in human language: "Dear journalctl, how many bytes of logs did you create during the last 24 hours?" Typically the manual is much better at providing answers in human friendly languages... man journalctl --disk-usage Shows the current disk usage of all journal files. This shows the sum of the disk usage ...


3

You can use systemd-journal-remote to convert like this journalctl -S @1500253701 -U @1500256701 -o export > foo.export systemd-journal-remote --output=foo.journald foo.export journalctl --file=foo.journald This information was added to the man page of journalctl in systemd 233, see commit.


3

Introduction Your original question pertains to how you can get more output from systemd. Have a look at How to debug systemd unit ExecStart But let's see if we can not get your service working first. About systemd Some issues ssh is forking after it has started. An ssh tunnel should run in the background A systemd process is by default run as type "...


3

I encountered a similar issue. As explained here, it turns out that you can't redirect output directly within ExecStartPre, ExecStart, or ExecStopPost commands - systemd will interpret the > or >> as arguments. The solution is to execute your command using sh -c. There's also one other issue I ran into when trying to use the date command in my ...


3

Currently, journalctl does not support patterns or wildcards in field matches. grep is your best option. I had the same problem, and I think that journalctl only searches for an exact match for VALUE when NAME=VALUE is passed as arguments. My investigations: man page From journalctl(1) The pattern is not mentioned in the description of the matches: [.....


2

The following output options display priority (and facility), but in a different format: journalctl -o verbose journalctl -o json (and json-pretty) journalctl -o export


2

The fix appears to be coming in https://github.com/systemd/systemd/pull/4970


2

Maybe it is a pipe between your daemon and systemd used for logging which is buffered? Possibly this is a duplicate of Output of a python script running as unit is out of order while shells seems unnafected where advice is: Adding sys.stdout.flush() after write or PYTHONUNBUFFERED environment will solve this problem Same advice is on Systemd journal ...


2

There is no journalctl in CentOS 6 because it's too old. CentOS 6 was released in 2010, and systemd was first released in 2011. You can find system logs in various files in the /var/log directory.


1

If this is a virtual guest, some guest integrations sync the time of the host to the guest. Check that the hypervisor is syncing time with NTP, so this time is at least correct. If you want to run in the wrong time for some reason, please edit your question to add why, and which virtual platform you use.


1

I did not find any matches there either. Then I did this journalctl _TRANSPORT=syslog and found that I did have matches. This led me to some investigation and I found that if I filtered for something specific, for example sshd, then I found matches although they look completely different. Here's an actual example: audit.log : type=CRED_REFR msg=audit(...


1

Use the --since option. To get logs from the last 10 minutes, just use: --since -10m That will give you logs 10 minutes prior to the current time. See the man page https://www.freedesktop.org/software/systemd/man/journalctl.html and this page on time specifications for systemd https://www.freedesktop.org/software/systemd/man/systemd.time.html#


1

It gives color to log files and command outputs. ccze -A tail -f /var/log/syslog | ccze dit to execute tail -f /var/log/syslog but here it shows with colors, another form could be ccze -A ccze -A ccze -h -o nolookups /root/syslog.html exports the log to HTML and saves it to /root/syslog.html.


1

I use ccze for all the logs. Example for jornalctl with color. journalctl -b -k -f | ccze journalctl -b -k -f | ccze -A Other examples. tail -f /etc/nginx/logs/access.log | ccze tail -f /etc/unbound/unbound.log | ccze Exporting logs to export the log to HTML and save it to /root/syslog.html: ccze -h -o nolookups /root/syslog.html I hope you find it ...


1

Try deleting /var/log/journal in case that there are any remainders from previous restoring attempts. Then set Storage=persistent in /etc/systemd/journald.conf and reboot. Normally systemd should recreate /var/log/journal during reboot. If this doesn't help try mkdir -p /var/log/journal systemd-tmpfiles --create --prefix /var/log/journal


Only top voted, non community-wiki answers of a minimum length are eligible