pyrox.dev
1<chapter xmlns="http://docbook.org/ns/docbook"
2 xmlns:xlink="http://www.w3.org/1999/xlink"
3 xmlns:xi="http://www.w3.org/2001/XInclude"
4 version="5.0"
5 xml:id="sec-logging">
6
7<title>Logging</title>
8
9<para>System-wide logging is provided by systemd’s
10<emphasis>journal</emphasis>, which subsumes traditional logging
11daemons such as syslogd and klogd. Log entries are kept in binary
12files in <filename>/var/log/journal/</filename>. The command
13<literal>journalctl</literal> allows you to see the contents of the
14journal. For example,
15
16<screen>
17$ journalctl -b
18</screen>
19
20shows all journal entries since the last reboot. (The output of
21<command>journalctl</command> is piped into <command>less</command> by
22default.) You can use various options and match operators to restrict
23output to messages of interest. For instance, to get all messages
24from PostgreSQL:
25
26<screen>
27$ journalctl -u postgresql.service
28-- Logs begin at Mon, 2013-01-07 13:28:01 CET, end at Tue, 2013-01-08 01:09:57 CET. --
29...
30Jan 07 15:44:14 hagbard postgres[2681]: [2-1] LOG: database system is shut down
31-- Reboot --
32Jan 07 15:45:10 hagbard postgres[2532]: [1-1] LOG: database system was shut down at 2013-01-07 15:44:14 CET
33Jan 07 15:45:13 hagbard postgres[2500]: [1-1] LOG: database system is ready to accept connections
34</screen>
35
36Or to get all messages since the last reboot that have at least a
37“critical” severity level:
38
39<screen>
40$ journalctl -b -p crit
41Dec 17 21:08:06 mandark sudo[3673]: pam_unix(sudo:auth): auth could not identify password for [alice]
42Dec 29 01:30:22 mandark kernel[6131]: [1053513.909444] CPU6: Core temperature above threshold, cpu clock throttled (total events = 1)
43</screen>
44
45</para>
46
47<para>The system journal is readable by root and by users in the
48<literal>wheel</literal> and <literal>systemd-journal</literal>
49groups. All users have a private journal that can be read using
50<command>journalctl</command>.</para>
51
52</chapter>