How to use the journalctl command?

By default, RHEL7's system uses two logging services for system logs, one of which is systemd-journald, which stores logs in memory. Another service is rsyslogd, which fetches logs from systemd-journald and stores them on disk.

To view information from the system log, a tool called journalctl can be used. If you do not add any parameters after the command, it will display the full contents of the system log.

The output of the journalctl command can be changed by options and filters. Option can be used to change the number of lines displayed by the command, turn on the relevant mode, change the display area, specify a time range, etc.

The filter can be used to modify the information of services and units to be displayed, and to display more information about execution.

By default, the directory where rhel7 stores system logs is / var/log/journal, which is cleared when the system is rebooted. By creating a new / var/log/journal directory, logs are automatically recorded in this directory and stored permanently.

1. Commonly used journalctl commands:

Journalctl-ef

This command is used to jump to the end of the log while maintaining a screen showing the newly entered log information

Journalctl _ SYSTEMD_UNIT=sshd.service

View logs generated by the sshd.service system unit

Journalctl-u sshd.service

View logs generated only by the sshd.service unit

Journalctl-p emerg..err

View logs with emerg priority and containing err

Journalctl-b-1

Used to display the log of the last system boot. This log information helps to find the cause of the system crash. A permanent storage location must be configured to collect the log. (/ var/log/journal)

Journalctl-since "2020-03-03 12:00:00"-- until "2020-03-04 12:00:00"

To view the logs from 2020-03-03 12:00:00 to 2020-03-04 12:00:00, you need to configure a permanent storage location. (/ var/log/journal)

Jourbalctl-o verbose

View the details of their respective logs by region name and their respective content

Create a permanent log storage directory

Mkdir / var/log/journal

Chown root:systemd-journal / var/log/journal

Chmod 2755 / var/log/journal

Systemctl restart systemd-journald