Protokolle & Journalctl

# View all logs
journalctl
 
# View the latest logs (tail)
journalctl -e
 
# Follow new logs in real time (similar to tail -f)
journalctl -f
 
# View the most recent N entries
journalctl -n 50
 
# Output without paging
journalctl --no-pager
 
# Reverse order (newest first)
journalctl -r

# Short format (default)
journalctl -o short
 
# Verbose format (shows all fields)
journalctl -o verbose
 
# JSON format
journalctl -o json
 
# JSON format (one entry per line, convenient for scripting)
journalctl -o json-lines
 
# Message content only
journalctl -o cat

# View logs for a specific service
journalctl -u nginx.service
 
# View logs for multiple services
journalctl -u nginx.service -u php-fpm.service
 
# Follow a specific service's logs in real time
journalctl -u myapp.service -f

# View logs from the current boot
journalctl -b
 
# View logs from the previous boot
journalctl -b -1
 
# List all boot records
journalctl --list-boots
 
# Specify a time range
journalctl --since "2026-03-24 10:00:00"
journalctl --since "2026-03-24 10:00:00" --until "2026-03-24 12:00:00"
 
# Use relative time
journalctl --since "1 hour ago"
journalctl --since "30 min ago"
journalctl --since today
journalctl --since yesterday --until today

# Show only errors and above
journalctl -p err
 
# Show only warnings
journalctl -p warning
 
# Show a range of priorities
journalctl -p warning..err

# By process PID
journalctl _PID=1234
 
# By user ID
journalctl _UID=1000
 
# By executable path
journalctl _EXE=/usr/bin/python3
 
# Combine conditions
journalctl _SYSTEMD_UNIT=nginx.service -p err --since today
 
# Kernel logs
journalctl -k
journalctl --dmesg

# Filter with grep
journalctl -u nginx.service | grep "error"
 
# Use journalctl's built-in matching
journalctl -g "failed|error|timeout"

sudo nano /etc/systemd/journald.conf

[Journal]
# Log storage mode: persistent (to disk), volatile (memory only), auto (default)
Storage=persistent
 
# Maximum disk space for logs
SystemMaxUse=500M
 
# Maximum size of a single log file
SystemMaxFileSize=50M
 
# Maximum retention time
MaxRetentionSec=1month
 
# Maximum memory usage for logs
RuntimeMaxUse=100M
 
# Log compression
Compress=yes
 
# Forward to syslog
ForwardToSyslog=yes
 
# Rate limiting: max 10000 entries per service per 30 seconds
RateLimitIntervalSec=30s
RateLimitBurst=10000

sudo systemctl restart systemd-journald

# Create the persistent log directory
sudo mkdir -p /var/log/journal
sudo systemd-tmpfiles --create --prefix /var/log/journal
 
# Or set it in the configuration file
# Storage=persistent
 
# Restart the service
sudo systemctl restart systemd-journald

# Clean by time: keep only the last 7 days of logs
sudo journalctl --vacuum-time=7d
 
# Clean by size: keep only 500MB of logs
sudo journalctl --vacuum-size=500M
 
# Clean by file count: keep only the 5 most recent log files
sudo journalctl --vacuum-files=5
 
# View current disk usage by logs
journalctl --disk-usage

# Check log file consistency
journalctl --verify

# Check if rsyslog is installed
dpkg -l rsyslog
 
# rsyslog log files are located under /var/log/
ls /var/log/syslog
ls /var/log/auth.log
ls /var/log/kern.log

# Main configuration file
sudo nano /etc/rsyslog.conf
 
# Custom rules go in this directory
ls /etc/rsyslog.d/

# /etc/rsyslog.d/nginx.conf
if $programname == 'nginx' then /var/log/nginx/syslog.log
& stop

# Main configuration file
cat /etc/logrotate.conf
 
# Application configurations directory
ls /etc/logrotate.d/

sudo nano /etc/logrotate.d/myapp

/var/log/myapp/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 myapp myapp
    sharedscripts
    postrotate
        systemctl reload myapp.service > /dev/null 2>&1 || true
    endscript
}

# Test logrotate manually
sudo logrotate -d /etc/logrotate.d/myapp    # dry-run
sudo logrotate -f /etc/logrotate.d/myapp    # force execution

# Create a script to monitor failed services
journalctl -p err -u "*.service" --since "5 min ago" --no-pager -o cat

# Export as a text file
journalctl -u nginx.service --since today > /tmp/nginx-today.log
 
# Export in binary format (readable by journalctl)
journalctl -u nginx.service -o export > /tmp/nginx.export

journalctl -k | grep -i "i/o\|error\|disk\|sda"

# View logs from the boot process
journalctl -b --no-pager | head -100