Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [journalctl]

Questions about journalctl - the tool used to manage, query and view logs on systemd setups.

0
votes
0answers
14 views

Limit journalctl to single user or process

When troubleshooting script ran by Apache, I use the following: journalctl -f -uhttpd When executed on the command line, under my normal username I first do: php testing_new_socket_server.php and ...
1
vote
0answers
14 views

How do you configure auditd logs to show up in journalctl?

I cannot find the usual auditd logs when doing "journalctl | grep msg=audit". However, I do see the auditd logs in /var/log/audit/audit.log and when doing ausearch. Is there a way to configure it so ...
0
votes
0answers
39 views

How to figure out what fields are available for a command / navigating man pages?

I'm studying how to review/query journal entries for RHEL8 using the journalctl command. In my book, I came across this section listing the fields that can be used for querying: _COMM The name of ...
0
votes
0answers
13 views

What does journal hostname field refer to?

I have a question about hostname field that journalctl displays. From journalctl documentation I know that _hostname= is displaying the name of the originating host. So in that case this log: march ...
0
votes
0answers
43 views

How to mount a partition's subdirectory for /var/log/journal?

Our server (Ubuntu 18) has a large partition mounted as /publish/data (its a VM, provided as IaaS so that is how it is mounted when extra disk space is requested), it is defined in fstab as follows: /...
-1
votes
1answer
77 views

How to let a specific group have read-access to systemd's journal?

How do I grant read-only permission to somegroup to read the system journal? (I'm on Debian10 buster). $ journalctl Hint: You are currently not seeing messages from other users and the system. ...
0
votes
1answer
34 views

Use journalctl to show logs of specific unit which has a parameter?

I have one systemd service which runs with systemctl --user start test_unit@random_arguments. How could I use journalctl to filter all logs of test_unit? If it supports "follow mode", that's even ...
2
votes
1answer
48 views

How I can preconfigure the write mode of drive cache?

journalctl -p err gives [sdX] Assuming drive cache: write through for each of my hard drives, where X is from a to f. These are normal hard drives, Ubuntu runs under VMWare. How I can preconfigure the ...
2
votes
2answers
39 views

Show journal logs from the time a service was restarted

Is there a canonical way to get all the logs from journalctl since a service was last restarted? What I want to do is restart a service and immediately see all the logs since I initiated the restart. ...
0
votes
0answers
68 views

systemd: process with fork() only shows logs after child exits

I have a program that fork()s and exits. Its child remains running for about 50 seconds, while it prints out messages each 5 seconds. When I run from a terminal it runs as expected, the parent exits, ...
2
votes
0answers
18 views

systemctl echos prints interference from other unit

I am working on a service which runs just fine. My poblem (or rather a mild annoyance) is that when I run systemctl status foo.service or journalctl -u foo.service I will occasionally see error ...
1
vote
1answer
93 views

Getting systemd service logs faster from my service

I'm having a systemd service defined as follows, that works fine: [Unit] Description=my service After=network.target [Service] User=myuser Group=mygroup WorkingDirectory=/home/myuser/myapp ...
3
votes
1answer
41 views

How do I work out which process/service/program is sending systemd dbus messages?

Currently my systemd journal is filling up with messages of the form: Feb 01 16:40:31 host systemd[1]: Got message type=method_call sender=:1.58666 destination=org.freedesktop.systemd1 object=/org /...
2
votes
1answer
79 views

How to show journal messages from all `fsck` units

Is there a reasonable procedure for a system administrator to view all the fsck messages? On my current Fedora 29 system, I can view all the fsck messages from my current boot like this: sudo ...
6
votes
2answers
2k views

How to watch output from systemd service?

I want to watch output from a systemd service on CentOS as if I have started this service from console. Yes, I can see output with journalctl, but it doesn't scroll to the bottom automatically. So how ...
2
votes
2answers
1k views

Where to find the log file of specific service

Using sudo journalctl -u {service} I can see the log of specific service. How to find the associated log file? What is the best way to monitor a log file programmatically? (I mean a program the react ...
0
votes
0answers
259 views

How to prevent “Kernel messages have been lost as the journal system has been unable to process them quickly enough.”?

$ sudo journalctl -x -b 0 shows: Sep 05 00:44:54 dom0 qrexec[4471]: qubes.GetDate: sys-firewall -> @default: allowed to dom0 Sep 05 00:44:54 dom0 runuser[4480]: pam_unix(runuser:session): session ...
0
votes
0answers
52 views

journalctl -f is spamming “cannot create session” and “session opened for root user”, how can I get it to stop/fixed?

I'm using fedora 28. I don't understand why I'm getting these messages and would love some help so I can use journalctl -f for other things. This is a fresh terminal window and I hadn't tried su ...
2
votes
1answer
2k views

gnome-shell error log

Where can I find gnome-shell error (or debug) log? I'm interested in mutter error/warning messages since I have a GLX problem I need to debug and I believe the key could be in gnome-shell's messages.
3
votes
0answers
450 views

Remove single line from journalctl file

I have an Ubuntu 18.04 server that is running a service I'm developing. The output is being sent to the system journal for logging. I accidentally failed to sanitize some logging and a plaintext ...
1
vote
1answer
1k views

Laptop wake up when lid is closed

I've a problem, every time I close the lid the laptop wakes up 2 seconds after (with the lid still closed) systemctl suspend/hibernates comes to the same result The problem happens on every linux ...
1
vote
0answers
755 views

pulseaudio.service “Failed to start Sound Service.”

On my desktop I get multiple errors regarding pulseaudio in journalctl after bootup: Jun 10 15:50:51 Workstation systemd[1146]: Failed to start Sound Service. ...
4
votes
1answer
315 views

Read exported journal with colors and bold

How inspect exported boot section from journalctl -b -1 > bootlog.txt in full color? Default exported format loses all colors and bold markup that is important to spot critical details. It is ...
1
vote
1answer
145 views

redundant systemd-journal-remote for systemd-journal-upload instances

I'm using systemd-journal-upload on serveral nodes to forward their journals to a single systemd-journal-remote sink, loghost01: /var/log/journal ├── <foo-bar> │ ├── system.journal │ └── ...
1
vote
1answer
1k views

journalctl to delete log

du -sh /var/log/journal/ 201M /var/log/journal/ journalctl --vacuum-size=10M Deleted archived journal /var/log/journal/5fabef35e4144feb92a9d7177b21d4e4/system@5dc54ed9ad1e41a785428a8ae2e88877-...
0
votes
1answer
331 views

View original kernel message timings from historical system logs

By default journalctl shows messages in the traditional system log format, including the CLOCK_REALTIME stamp, i.e. wall clock time (and calendar date). However, this doesn't show accurate timestamps ...
1
vote
1answer
514 views

How to configure journald to discard entries older than a certain time span

From the documentation I know that I can configure the time after which journal files are deleted via MaxRetentionSec. the time after which journal files are rotated via MaxFileSec. However my goal ...
12
votes
4answers
27k views

How to see the latest x lines from systemctl service log

I'm looking for a way, to simply print the last X lines from a systemctl service in Debian. I would like to install this code into a script, which uses the printed and latest log entries. I've found ...
2
votes
0answers
1k views

Print only timestamp and message in journalctl

I'm trying to get the last few lines from journalctl so I can feed them into my conky. However journalctl by default provides too much crap that wastes space: With journalctl -u PROCESS -n 5 --no-...
3
votes
1answer
908 views

Why journalctl does not display log message if I use filtering by unit?

I'm using Ubuntu 16.04 and I am seeing some strange behavior when analyzing journalctl logs. Here's unfiltered output (I used json output to hopefully include all relevant fields): $ journalctl -o ...
1
vote
1answer
1k views

Prevent syslogs from being logged under journalctl

I have a simple Python snippet managed by a systemd service which logs to the rsysogd daemon where I've defined a configuration file to put it to a syslog server with a format I've defined. This is ...
0
votes
0answers
427 views

systemd-journald missing crash logs

I am running Arch-ARM on RPi3. I have noticed when system crashes I cannot find any related crash log in journal logs. Arch Linux ARM on RPi3: Linux 4.4.37-1-ARCH #1 SMP armv7l GNU/Linux Systemd: ...
3
votes
3answers
4k views

Can I mask the systemd-journal-flush service and run journalctl --flush later manually?

On my archlinux installation, I realised that flushing the journal logs to disk by the systemd-journal-flush service significantly prolongs the boot process and masking the service improves boot time. ...
2
votes
1answer
344 views

systemctl fails to start a service and journalctl fails to report is correctly, how to deal with it?

I simply do: systemctl start wpa_supplicant No errors --- I get a new prompt. Ok, so far, so good. I check journalctl. wpa_supplicant[622]: Successfully initialized wpa_supplicant Nothing more, ...
1
vote
1answer
953 views

Solus distro is not booting anymore

Everything worked fine last time I used Solus, and now I cannot boot because of the error below. Let's try to solve it without using a live USB. **Failed to start File System Check on /dev/disk/by-...
1
vote
1answer
1k views

Why `journalctl --list-boots` doesn't match what `uptime` and `who -b` report?

Here's a test script I used: last_reboot=$(last reboot | grep 'still running' | awk '{for (i=5; i<=NF; i++) printf $i FS}' | awk '{for (i=1; i<=NF - 2; i++) printf $i FS}') if [ "$last_reboot" ]...
2
votes
0answers
138 views

Why journalctl outputs in ASCII?

I have a regular Ubuntu 16.04 server VM. My locale is set up to utf-8 everywhere: $ locale LANG=en_US.UTF-8 LANGUAGE= LC_CTYPE="en_US.UTF-8" LC_NUMERIC="en_US.UTF-8" LC_TIME="en_US.UTF-8" LC_COLLATE="...
1
vote
2answers
440 views

How to use systemd aliases with journalctl?

I defined a systemd service, which has a name I always mistype (kafka in this instance) so I gave it a few easy aliases. In the systemd files, it means that I have the line: Alias=k.service kakfa....
4
votes
1answer
681 views

journalctl shows very old boots which are not recycled

The system has very old boots (2 and 3 years old), which are not recycled and I haven't been able to vacuum them: $ journalctl --list-boots --no-pager -16 53baf678f0d749d6b390afea4a3ef96b Wed 2014-04-...
2
votes
2answers
555 views

How to know exactly when a Linux service went inactive?

I'm using RHEL 7, and would like to know if and when a particular service 'myservice.service' went inactive. Unfortunately, using: journalctl -u myservice.service only seems to show output from my ...
1
vote
1answer
6k views

Setting up journalctl on Ubuntu Linux

I am trying to use journalctl on my remote Ubuntu Linux box. I understand that I need to setup a config file journald.conf under /etc/systemd/ folder with permissions. But What I am struggling to ...
7
votes
1answer
4k views

What is the difference between dmesg and journalctl [closed]

I am completely new in Linux. What I see are two logs that run approximately in the same way. Why there are two logs? What kind of messages I expect to see in each of them? And what is the difference ...
2
votes
0answers
1k views

journalctl: unrecognized option '--vacuum-size= '

All environment info on my os. debian8@debian:~$ uname -a Linux debian 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1+deb8u2 (2017-03-07) x86_64 GNU/Linux debian8@debian:~$ systemd --version systemd 215 +PAM ...
1
vote
0answers
311 views

How can I view all system logs at once?

My computer is constantly making the sound of a usb device being un-plugged and plugged in (about once a minute). It's driving me crazy. I've run journalctl --follow as root, but there are no ...
0
votes
1answer
446 views

cannot read saved journalctl logs

Reading the content of man journalctl, I came across the following: Storage= Controls where to store journal data. One of "volatile", "persistent", "auto" and "none". If "volatile", journal ...
7
votes
1answer
539 views

How does journalctl sign the logs if the “The verification key should be stored externally.”?

$ man journalctl ... --setup-keys Instead of showing journal contents, generate a new key pair for Forward Secure Sealing (FSS). This will generate a sealing key and a verification key. The sealing ...
3
votes
1answer
3k views

Is it possible to reduce systemd-journald size stored format (and thus size)?

I'm using systemd on raspberrypi machine with yocto based system. Recently I had some problems with redirecting messages to rsyslog.socket so I decided to get rid of rsyslog completely in favour of of ...
0
votes
1answer
232 views

does journalctl eliminate the need for most logging?

I am playing around with journalctl and getting used to the whole systemd setup, but having a hard time defining what it is actually doing... this site (https://www.loggly.com/ultimate-guide/using-...
4
votes
1answer
736 views

systemd - journalctl output always shows the parent process name in log entries

I have a process which is started by systemd - lets call it A. This process spawns numerous child processes - lets just take one and call it B. This is a C++ application. When you print to std::cout ...
0
votes
1answer
81 views

Getting dates of password changed in journalctl

I can get the last password changed using passwd -Sa, but how to get 2nd last password change date? and if possible its IP Address?