Linux journalctl Command with Practical Examples

Introduction

In this lab, we will explore the Linux journalctl command, which is a powerful tool for viewing and analyzing the system logs maintained by the systemd journal. The lab will cover the purpose and functionality of journalctl, as well as its various filtering options to help you effectively manage and troubleshoot your Linux system. We will start by understanding the purpose of the systemd journal and how to use journalctl to access the logs. Then, we will dive deeper into the filtering capabilities of journalctl to help you quickly find the relevant information you need. Finally, we will demonstrate practical examples of using journalctl commands to analyze the system logs.

Linux Commands Cheat Sheet

Skills Graph

Understand the Purpose and Functionality of journalctl

In this step, we will explore the purpose and functionality of the journalctl command in Linux. The journalctl command is a powerful tool used to view and analyze the system logs maintained by the systemd journal.

First, let's understand the purpose of the systemd journal. The systemd journal is a logging system that collects and stores system logs, including messages from the kernel, system services, and user applications. The journalctl command provides a way to access and interact with these logs.

To begin, let's run the journalctl command without any options:

sudo journalctl

This will display the entire log history maintained by the systemd journal. The output will include various log entries, such as system startup messages, service status updates, and error reports.

Example output:

-- Logs begin at Tue 2023-04-25 10:00:00 UTC, end at Tue 2023-04-25 10:05:00 UTC. --
Apr 25 10:00:00 labex systemd[1]: Starting Login Service...
Apr 25 10:00:01 labex systemd[1]: Started Login Service.
Apr 25 10:00:01 labex sshd[123]: Server listening on 0.0.0.0 port 22.
Apr 25 10:00:02 labex sshd[123]: Server listening on :: port 22.
Apr 25 10:00:02 labex sshd[124]: Accepted password for labex from 10.0.2.2 port 49876 ssh2

As you can see, the journalctl command displays the log entries in chronological order, with each entry containing a timestamp, the hostname, and the log message.

Now, let's explore some of the key functionality of the journalctl command:

1. Filtering logs: You can filter the log entries based on various criteria, such as the log level, the service or unit that generated the log, or the timestamp. We'll cover more advanced filtering options in the next step.
2. Viewing logs for specific services: You can view the logs for a specific service or system unit by using the -u option followed by the service name. For example, sudo journalctl -u sshd.service will display the logs for the SSH daemon.
3. Viewing logs for the current boot: You can view the logs for the current boot session by using the -b option. This is useful for troubleshooting issues that occurred during the most recent system startup.
4. Viewing logs in real-time: You can use the -f option to follow the log in real-time, similar to the tail -f command.

In the next step, we'll dive deeper into the filtering options available with the journalctl command and explore more practical examples.

Explore journalctl Filtering Options

In this step, we will explore the various filtering options available with the journalctl command. Filtering allows you to narrow down the log entries and focus on specific information that is relevant to your troubleshooting or monitoring needs.

Let's start by filtering the logs based on the log level. To view only the error and critical log entries, you can use the -p (priority) option:

sudo journalctl -p err..crit

This will display only the log entries with a priority level of "error" or higher (critical).

Example output:

Apr 25 10:00:00 labex systemd[1]: Failed to start Login Service.
Apr 25 10:00:01 labex sshd[123]: error: Could not load host key: /etc/ssh/ssh_host_rsa_key

Next, you can filter the logs based on a specific service or system unit. For example, to view the logs for the SSH daemon, you can use the -u (unit) option:

sudo journalctl -u sshd.service

This will display all the log entries related to the SSH daemon.

You can also filter the logs based on a specific time range. To view the logs for the last 30 minutes, you can use the -n (number) and -s (since) options:

sudo journalctl -n 100 -s "30 minutes ago"

This will display the last 100 log entries from the last 30 minutes.

Another useful filtering option is the -b (boot) option, which allows you to view the logs for a specific boot session. For example, to view the logs for the current boot session, you can use:

sudo journalctl -b

You can also combine multiple filtering options to further refine your search. For instance, to view the error and critical log entries for the SSH daemon in the last 30 minutes, you can use:

sudo journalctl -u sshd.service -p err..crit -n 100 -s "30 minutes ago"

By exploring these filtering options, you can effectively navigate and analyze the system logs to troubleshoot issues, monitor system health, and gain valuable insights into your Linux environment.

In the next step, we'll dive deeper into more advanced use cases and practical examples of the journalctl command.

Analyze Logs Using journalctl Commands

In this final step, we will explore more advanced use cases of the journalctl command to analyze system logs effectively.

One powerful feature of journalctl is the ability to view logs in a structured format. By default, journalctl displays the logs in a human-readable format, but you can use the -o (output) option to change the output format. For example, to view the logs in JSON format, you can use:

sudo journalctl -o json

This will display the log entries in a structured JSON format, which can be useful for programmatic analysis or integration with other tools.

Another useful feature is the ability to view the logs for a specific process or application. You can use the -u (unit) option to filter the logs by a specific service or system unit, as we saw in the previous step. Additionally, you can use the -t (identifier) option to filter the logs by a specific process ID (PID) or executable name. For example, to view the logs for the sshd process, you can use:

sudo journalctl -t sshd

This will display all the log entries related to the sshd process.

You can also use the --since and --until options to filter the logs by a specific time range. For example, to view the logs for the last 24 hours, you can use:

sudo journalctl --since "1 day ago"

This will display all the log entries from the last 24 hours.

Finally, you can use the --follow (-f) option to continuously monitor the log entries in real-time, similar to the tail -f command. This can be useful for tracking live events or troubleshooting issues as they occur.

sudo journalctl -f

By combining these advanced features, you can effectively analyze and troubleshoot system issues using the journalctl command. Remember, the more you practice with journalctl, the more comfortable you'll become in navigating and interpreting the system logs.

Summary

In this lab, we first explored the purpose and functionality of the journalctl command in Linux. We learned that the journalctl command is used to view and analyze the system logs maintained by the systemd journal, which collects and stores logs from the kernel, system services, and user applications. We then ran the journalctl command without any options to see the entire log history, and discussed the key features of the command, including the ability to filter logs based on various criteria and view logs for specific services.

Next, we will explore the advanced filtering options available with the journalctl command, and learn how to analyze the logs using various commands.

Linux Commands Cheat Sheet