All right, let's talk about journalctl and how to work with it.
So in journalctl there is different commands that are available.
If you just type journalctl, you get the complete journal
and you can use spacebar to scroll through it.
It's opening in a less pager. So if you know how to work with less, you know
how to work with the journal. CTL output journalctl u allows you to find information about specific
units, and you can use tab completion for more information about units that are available.
Journalctl dmessage is an alternative for the old dmessage
command and it will show you kernel messages.
You can also combine filters like journalctl u cron d since yesterday until 9
pinfo, which has a time range and then a new option b for priority,
the priority info that will basically show you anything that has been logged.
Not the most useful thing to try, but if you want to try the command and see
that it works, binfo increases the chance that you will actually see something in real life. Probably
you want to do journalctl ber for the priority error, because that is what really matters.
Now there is one challenge in the journal D and that is that the systemd journal by default is not persistent.
But fortunately most Linux distributions have the option storage is auto in etcsystemd journald.com
and this setting makes that if a directory var log journal is created, the
journal will be saved persistently. But you will need to use systemctl start journal
flush to make the persistent log effective without a need to reboot.
Let me show you.
Okay, so let me do all of this from root shell using sudo I.
Because journalctl does require super user powers. If I just type journalctl it
shows from the start and I can use spacebar to move forward.
And there's a lot of lines using uppercase g. You can see we have about 70,000 lines in total.
Now that requires some filtering. So let's do a journalctl u tab tab oh
boy, all 790 possibilities. Yeah, you can easily filter on that. And if you
already know what you want to do, then look for that like USSHD service.
Then if I use journalctl d message and it's more focused and we
see kernel related messages, that is what you want to do to troubleshoot
on features that relate to the kernel and not to specific services.
You can do this filtering journalctl U why not Cron
d since yesterday and until until now in p info
and oh boy, we don't see any entries. Well, that's
possible because of the time filtering and maybe nothing has
been logged between yesterday and now.
Let me just do the P info and there you can see a lot of messages that have been logged.
Now as I mentioned, the P info is not really what you
should be interested in, but journalctl will show error messages only, and
that might really help you in troubleshooting what is going on.
Now one more thing I would like to show you, and that
is journalctlxb b is for the bootlog and X is for explanation.
The result of this explanation is that where possible you will get some lines
in green that are adding an explanation telling you what exactly is going wrong.
And these were the most common commands that people normally use in journal CTL.