journald is part of systemd and responsible for collecting system logs

learn more… | top users | synonyms

4
votes
2answers
43 views

How to fix unit attribution of last lines of systemd logging before exit?

I have a systemd service which logs to stdout. From there, systemd captures STDOUT and writes it to the journal. I use a common idiom for handling an error where I echo some diagnostics, then exit ...
2
votes
2answers
39 views

systemd: lie about process name using sh -c exec idiom

I'm using the sh -c exec idiom in an ExecStart statement (in a service unit file) to interpolate some shell commands. For example: ExecStart=/bin/sh -ec "exec /usr/bin/foo $(/usr/bin/foo-config)" ...
1
vote
0answers
48 views

Why does journalctl say “— no entries --”?

For example: ┌─[10:50:38/hypership/root/~] └─╼ journalctl -b No journal files were found. -- No entries -- ┌─[10:50:46/hypership/root/~] └─╼ journalctl --verify No journal files were found. /var/...
1
vote
0answers
23 views

filter journalctl output, preserve color [duplicate]

I am using journalctl to watch the system by journalctl -f -p 4, but I'd like to grep-out some information. This works: journalctl -f -p 4|grep -v "maximal mount", but grep discards any color info, a ...
0
votes
2answers
13 views

How to get the current _BOOT_ID in journald

How to obtain the current value of _BOOT_ID in systemd-journald? I can do something ugly such like: journalctl -o verbose --since '2016-05-17' | egrep '^[ ]+_BOOT_ID' | tail -n 1| cut -d"=" -f2 ...
1
vote
0answers
14 views

Store messages from previous boots while keeping immediate log output

As this answer suggests, the way to enable storing logs across boots is: # mkdir /var/log/journal # systemd-tmpfiles --create --prefix /var/log/journal # systemctl restart systemd-journald But when ...
2
votes
1answer
38 views

In journald, why are some sshd log entries not attributed to ssh.service

When using journalctl to inspect my journald logs the output from the commands journalctl -u ssh.service and journalctl _COMM=sshd differ. The first command produces just a subset of the log ...
0
votes
0answers
42 views

no MariaDB logs in journalctl

With jounralctl I see no logs for MariaDB, but for puppet every run. # journalctl -u mariadb -- Logs begin at Mon 2016-02-29 06:26:34 CET, end at Mon 2016-04-04 18:23:00 CEST. -- # systemctl status ...
1
vote
1answer
369 views

How do I clear journalctl entries for a specific unit only?

I spent a few days writing a python script, and creating a systemd unit file for it. During testing, the script logged a lot of errors to journald. I would like to clear those errors from journald now ...
2
votes
0answers
45 views

How would I limit users' sudo permissions for journalctl to a specific unit?

I want to provide our users access to journalctl of a specific unit. For e.g., httpd. My initial thought was to specify the command spec like this: /usr/bin/journalctl -u httpd.service * This will ...
0
votes
0answers
14 views

journald 'forgets' correct unit name for shell-based units?

With a unit file like this one here, and an (exectuable, with shebang) shell script as named: [Service] Type=oneshot ExecStart=/some/shell/script.sh I get journal output like this: Mar 10 17:11:27 ...
0
votes
1answer
145 views

How to configure fail2ban with systemd journal?

I've install fail2ban on Debian Jessie LXC container, currently it's failing due to: Starting authentication failure monitor: fail2ban ERROR No file(s) found for glob /var/log/auth.log ERROR Failed ...
0
votes
0answers
37 views

Filter logs with journald

A monitoring service that executes every minute requires sudo. With this my logs are full of pam_unix entries, telling me that this service logged in with sudo. Now that I have journald on this ...
0
votes
0answers
93 views

Syslog stopped logging after using journalctl

Today I was configuring some things in my VPS running CentOS 7, and checked /var/log/secure several times without noticing any problems.Later I used journalctl to look for some cron logs, and now it ...
3
votes
0answers
220 views

Why does my user's login cause systemd to use up a CPU?

Recently I asked this question and this one about systemd and a few related processes using 100% CPU just 5 minutes after every boot. I have a quadcore Intel processor, each core has two virtual ...
1
vote
2answers
85 views

How to tell journald to re-read its configuration?

My question is simple: how do I tell journald to re-read its configuration file without rebooting? I've made some changes to /etc/systemd/journald.conf and I'd like to see if they are correct and ...
1
vote
1answer
124 views

How can I see all journald entries in Centos 7?

From what I have learned, Centos 7 (by default) keeps log journal entries in memory only so these are lost when machine is rebooted. I'm comfortable with the fact that I can only see messages from ...
0
votes
1answer
49 views

Remove header in journalctl results

Sample Command run on RHEL 7: $ journalctl -n1 -- Logs begin at Tue 2015-09-29 17:44:38 PDT, end at Thu 2015-10-22 10:51:35 PDT. -- Oct 22 10:46:00 linuxdev sshd[9730]: pam_unix(sshd:session): ...
1
vote
1answer
174 views

script can't write to systemd journal

to make it short: I want to write to the systemd journal from a script. printf "%s\n%s\n%s\n" CODE_FILE=/etc/zsh/zprofile CODE_LINE=31 MESSAGE="could not read /etc/dircolors" | logger --journald ...
8
votes
1answer
352 views

How to avoid /usr/bin/env being marked in systemd logs as the executable

I've created a systemd service to run a tomcat application based on the information found in this article. The short version of the article recommends avoiding the shell script wrappers, and executing ...
0
votes
2answers
3k views

Tomcat 7 not producing log output to catalina.out on RHEL7

I have a RHEL7 server with Apache Tomcat 7.0 installed and after a recent update to RHEL7.1 all of the logging to ${catalina.base}/logs/catalina.out was stopped. However I am receiving the logs inside ...
0
votes
1answer
304 views

Wrong timestamp in systemd log

I read systemd log of my home server using journalctl and I've noticed that the timestamp of log is totally out of order. Here's some logs from my server using journalctl -o=short-iso --since=...
0
votes
1answer
713 views

How to read *.journal files in Fedora 21?

I want to see the previous dmesg log before the reboot. In previous versions of fedora, It used to be in /var/log/messages. But from Fedora 20, it's being stored through systemd i.e. journalctl. I've ...
2
votes
1answer
873 views

Howto inspect systemd system.journal from another system

I have arch linux failing on a device. The device doesn't have any screen, it doesn't respond to network. So I take its SD card, insert it in ubuntu desktop, see a fresh system.journal there and... ...
1
vote
1answer
93 views

How do I get xconsole to show the messages on a system with journald?

I would like an old style xconsole on my desktop, ie a terminal which display a scrolling list of syslog message. Does the journald system have a nice desktop app or is there a simple way to get it ...
3
votes
1answer
596 views

Rsyslog `logger` message duplicated

I just had a problem with rsyslog's imjournal module, possibly the issue described here, whereby complications with systemd's journal cause the journal to return the same data endlessly in a ...
1
vote
1answer
299 views

Configure systemd-journal-gateway on CentOS7

I installed systemd-journal-gatewayd on CentOS7 and started it. If I connect to the given port the HTTP server is answering but the response is always emtpy. Neither /entries?follow nor /entries?boot ...
4
votes
1answer
762 views

Why is my systemd journal not persistent across reboots?

I'm experiencing a very weird issue with a fresh Fedora 21 image on a Linode instance. I cannot reproduce it outside of Linode. The issue is that my systemd journal is not persistent across reboots. ...
3
votes
1answer
571 views

How can I get a list of login attempts with journalctl?

According to the systemd docs, journalctl is recommended for browsing logs, rather than the /var/log/* file tree. While man 1 journalctl describes how to use it, I still don't know what arguments it ...
1
vote
0answers
326 views

Should I use separate log files or log everything to the journal?

On my personal server I currently have multiple services (web server, mail server, etc) and some of them have their own log files while others log everything to stdout and that gets picked up by the ...
1
vote
1answer
81 views

How can I change the save location of the system journal?

(for an Arch Linux system) Is it possible to change the storage location of the system journal to a specific directory?
2
votes
1answer
210 views

How to direct the journal output of certain units to a particular file?

I've got a system with several daemons running (as systemd units) that output log information to the journal in Arch Linux. I want to direct the journal output of some of those unit files into a ...
4
votes
1answer
1k views

Output of a python script running as unit is out of order while shells seems unnafected

How would I get all outputs of systemd managed python2 script instantly into journal, just like it appears in terminal I'm on centos 7, but seems to be same on arch according to systemd manual, ...
21
votes
2answers
20k views

How display log messages from previous boots under CentOS 7?

Executing journalctl under a CentOS 7 system just prints messages generated after the last boot. The command # journalctl --boot=-1 prints Failed to look up boot -1: Cannot assign requested ...
2
votes
1answer
607 views

Missing systemd journal log

While reviewing my journal log, I find that only logs for the recent three days are present. There is only 8 lines worth of log from between September 19 and 27: # journalctl --since="2014-09-19" --...
0
votes
1answer
3k views

How to surpress audit daemon rotating log messages?

On a CentOS 7 system messages like these are logged several times a day: Sep 24 00:11:42 example.org auditd[756]: Audit daemon rotating log files Sep 24 00:26:23 example.org auditd[756]: Audit daemon ...
1
vote
1answer
191 views

How to determine a log's source process spawned from a systemd service?

I have a systemd service which starts multiple 3rd-party processes which output to standard output. Is there anyway to easily determine which logs are from specific process from the system journal? ...
1
vote
0answers
197 views

clamd randomly stops

I am using clamav in conjuction with c-icap to filter content with squid. I am also using the safebrowsing functionality of clamav to block access to bad domains. For some reason or another, clamav (...
41
votes
5answers
33k views

How to clear journalctl

I couldn't find in google any safe way to clear systemd journal. Do anyone know any safe and reliable way to do so? Added: As a reason, let's say I was experimenting with something and my logs got ...
7
votes
1answer
2k views

How to get access to the root journal for systemd?

When I execute journalctl -f -a under Fedora 20 for different users I get different results. For root I get something similar to tail -f /var/log/syslog on older systems. As normal user I get gnome-...
1
vote
1answer
324 views

journalctl process groups

I recently tried setting up the ChrootDirectory property in sshd_config and ran into the ownership problems for chroot targets. After i have fixed the problem i noticed that syslog-ng had created log ...
1
vote
0answers
463 views

Suggestions to debug missing kernel messages from systemd journal

I have recently been playing around with a new freescale i.mx6 system. I have installed archlinuxarm on it. Strangely, all kernel messages are missing from the journal. $ sudo journalctl -k -- ...
4
votes
2answers
8k views

Log every command typed in any shell: output (from logger function to syslog-ng/journald) contains duplicate entries for commands?

I installed syslog-ng to use on my desktop (Gentoo 64bit, upgraded to systemd i.e. was OpenRC before, with Openbox and Slim only) with my normal user to log all commands I type in the shell (bash ...
10
votes
1answer
13k views

Where does `logger` log its messages to in Arch Linux?

The logger command logs an entry via syslog, which usually puts that line to some file like /var/log/messages. If I understand the documentation correctly in Arch Linux all the logging is done ...
9
votes
2answers
3k views

journalctl --verify reports corruption

I just noticed this verify option for journalctl and decided to give it a go, it's showing corruption, what might cause that? and what if anything should I do about it? should I investigate further? ...
2
votes
0answers
237 views

smartd custom logfile on systemd + journald based system

An excerpt from smartd manpage reads: -l FACILITY, --logfacility=FACILITY Uses syslog facility FACILITY to log the messages from smartd. Here FACILITY is one of local0, local1, ..., local7, or ...
6
votes
2answers
346 views

Debugging lock-up - systemd loses my logs

Ever since I have "upgraded" to systemd on Arch Linux, I keep losing logs when an unexpected lockup happens. I hit the same log-losing issue one month ago and just hit the issue again. There are also ...