From a1e91fec2ac77c82a460ae1ae189ffca40ed00b1 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Thu, 11 Sep 2025 11:36:49 +0530 Subject: [PATCH 01/32] New Smartdocs for journalctl --- DC-SLES-journalctl | 19 ++++ articles/journalctl.asm.xml | 171 ++++++++++++++++++++++++++++++++++++ 2 files changed, 190 insertions(+) create mode 100644 DC-SLES-journalctl create mode 100644 articles/journalctl.asm.xml diff --git a/DC-SLES-journalctl b/DC-SLES-journalctl new file mode 100644 index 000000000..4dc536b8e --- /dev/null +++ b/DC-SLES-journalctl @@ -0,0 +1,19 @@ +# This file originates from the project https://github.com/openSUSE/doc-kit +# This file can be edited downstream. + +## Basics +MAIN="cockpit.asm.xml" +SRC_DIR="articles" +IMG_SRC_DIR="images" + +## Profiling +PROFOS="sles" +PROFCONDITION="16.0" +STRUCTID="sles-cockpit" +#PROFARCH="x86_64;zseries;power;aarch64" + +DOCBOOK5_RNG_URI="urn:x-suse:rng:v2:geekodoc-flat" + +## stylesheet location +STYLEROOT="/usr/share/xml/docbook/stylesheet/suse2022-ns" +FALLBACK_STYLEROOT="/usr/share/xml/docbook/stylesheet/suse2021-ns" \ No newline at end of file diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml new file mode 100644 index 000000000..df1a84fd3 --- /dev/null +++ b/articles/journalctl.asm.xml @@ -0,0 +1,171 @@ + + + + %entities; +]> + + + + + + + + + + + + + + + + + + + Legal Notice + + + GNU Free Documentation License + + + + + Viewing logs using &journalctl; + + + 2025-09-11 + + + Initial version + + + + + + + + + &x86-64; + &power; + &zseries; + &aarch64; + + + + &sles; + &sles4sap; + &sleha; + + + View logs using &journalctl; + + How to view and manage &productnameshort; logs using &journalctl; + + View &productnameshort; logs using &journalctl; + + + Configuration + Storage + Maintenance + Administration + + + Systems Management + + + Products & Solutions + + + + https://bugzilla.suse.com/enter_bug.cgi + Documentation + SUSE Linux Enterprise Server 16.0 + SUSE Linux Enterprise Server 16.0 + SUSE Linux Enterprise Server 16.0 + shalaka.harne@suse.com + + yes + + + + + WHAT? + + + You can view and analyze logs from &systemd-journald; using the &journalctl; command-line tool. + + + + + WHY? + + + This article is intended to provide a complete overview of + tasks that can be performed using the &journalctl; command-line tool. + + + + + EFFORT + + + The average reading time of this article is approximately 30 minutes. + + + + + GOAL + + + You will be able to view your system logs using &journalctl;. + + + + + REQUIREMENTS + + + To fully view the system-wide logs such as kernel, system services, or other user logs using &journaltl; command-line tool, you must have + &sudo; privileges. + + The &systemd-journald; service must be running as it collects the logs. + For persistent logs across reboots, var/log/journal file must be available. Volatile logs are saved in /run/log/journal + + + + + + + + + + Using the &cockpit; Overview part, you can + perform changes to the default server configuration or the + configuration you provided during the manual installation. In this + part, you can change the host name or change the system date or time + zone. + + + + + + + + + + + + + + + + + + + From fdca76273052610305e4bcb604edb4b8f5749f13 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Sun, 23 Nov 2025 18:17:51 +0530 Subject: [PATCH 02/32] New topic. --- DC-SLES-journalctl | 3 +- articles/journalctl.asm.xml | 305 +++++++++++------------ concepts/journal-about-journald.xml | 363 ++++++++++++++++++++++++++++ 3 files changed, 509 insertions(+), 162 deletions(-) create mode 100644 concepts/journal-about-journald.xml diff --git a/DC-SLES-journalctl b/DC-SLES-journalctl index 4dc536b8e..0aaa4826a 100644 --- a/DC-SLES-journalctl +++ b/DC-SLES-journalctl @@ -2,14 +2,13 @@ # This file can be edited downstream. ## Basics -MAIN="cockpit.asm.xml" +MAIN="journalctl.asm.xml" SRC_DIR="articles" IMG_SRC_DIR="images" ## Profiling PROFOS="sles" PROFCONDITION="16.0" -STRUCTID="sles-cockpit" #PROFARCH="x86_64;zseries;power;aarch64" DOCBOOK5_RNG_URI="urn:x-suse:rng:v2:geekodoc-flat" diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml index df1a84fd3..f0e22f723 100644 --- a/articles/journalctl.asm.xml +++ b/articles/journalctl.asm.xml @@ -3,169 +3,154 @@ type="application/relax-ng-compact-syntax"?> - %entities; + +%entities; ]> - - - - - - - - - - - - - - - - - Legal Notice - - - GNU Free Documentation License - - - - - Viewing logs using &journalctl; - - - 2025-09-11 - - - Initial version - - - - - - - - - &x86-64; - &power; - &zseries; - &aarch64; - - - - &sles; - &sles4sap; - &sleha; - - - View logs using &journalctl; - - How to view and manage &productnameshort; logs using &journalctl; - - View &productnameshort; logs using &journalctl; - - - Configuration - Storage - Maintenance - Administration - +xmlns:xlink="http://www.w3.org/1999/xlink" +xmlns:trans="http://docbook.org/ns/transclusion" +xmlns:its="http://www.w3.org/2005/11/its" +xmlns="http://docbook.org/ns/docbook"> + + + + + + + + + + +Legal Notice + + +GNU Free Documentation License + + + + +Viewing logs using &journalctl; + + +2025-09-10 + + +Initial version + + + + + + + + +&x86-64; +&power; +&zseries; +&aarch64; + + + +&sles; +&sles4sap; +&sleha; + + +View logs using &journalctl; + +How to view and manage &productnameshort; logs using &journalctl; + +View &productnameshort; logs using &journalctl; + + +Configuration +Storage +Maintenance +Administration + - Systems Management - - - Products & Solutions +Systems Management + + +Products & Solutions - - - https://bugzilla.suse.com/enter_bug.cgi - Documentation - SUSE Linux Enterprise Server 16.0 - SUSE Linux Enterprise Server 16.0 - SUSE Linux Enterprise Server 16.0 - shalaka.harne@suse.com - - yes - - - - - WHAT? - - - You can view and analyze logs from &systemd-journald; using the &journalctl; command-line tool. - - - - - WHY? - - - This article is intended to provide a complete overview of - tasks that can be performed using the &journalctl; command-line tool. - - - - - EFFORT - - - The average reading time of this article is approximately 30 minutes. - - - - - GOAL - - - You will be able to view your system logs using &journalctl;. - - - - - REQUIREMENTS - - - To fully view the system-wide logs such as kernel, system services, or other user logs using &journaltl; command-line tool, you must have - &sudo; privileges. - - The &systemd-journald; service must be running as it collects the logs. - For persistent logs across reboots, var/log/journal file must be available. Volatile logs are saved in /run/log/journal - - - - - - - - - - Using the &cockpit; Overview part, you can - perform changes to the default server configuration or the - configuration you provided during the manual installation. In this - part, you can change the host name or change the system date or time - zone. - - - - - - - - - - - - - - - - - - + + +https://bugzilla.suse.com/enter_bug.cgi +Documentation +SUSE Linux Enterprise Server 16.0 +SUSE Linux Enterprise Server 16.0 +SUSE Linux Enterprise Server 16.0 +shalaka.harne@suse.com + +yes + + + + +WHAT? + + +You can view and analyze logs from &systemd-journald; using the &journalctl; command-line tool. + + + + +WHY? + + +This article is intended to provide a complete overview of +tasks that can be performed using the &journalctl; command-line tool. + + + + +EFFORT + + +The average reading time of this article is approximately 30 minutes. + + + + +GOAL + + +You will be able to view your system logs using &journalctl;. + + + + +REQUIREMENTS + + +To fully view the system-wide logs such as kernel, system services, or other user logs using &journaltl; command-line tool, you must have +&sudo; privileges. + +The &systemd-journald; service must be running as it collects the logs. +For persistent logs across reboots, var/log/journal file must be available. Volatile logs are saved in /run/log/journal + + + + + + + + + +You can view &systemd; logs using journalctl. + + + + + + + + diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml new file mode 100644 index 000000000..1c2b50e64 --- /dev/null +++ b/concepts/journal-about-journald.xml @@ -0,0 +1,363 @@ + + + %entities; +]> + + + + + + + About journald + + + + systemd uses journald as its logging system. All system events are written to the journal, a system service managed by systemd-journald.service (journald). This allows you to search and manage all system logs. It collects and stores logging data by maintaining structured indexed journals based on logging information received from the kernel, user processes, standard input, and system service errors. + + + + + The systemd-journald service is enabled by default. + + &prompt.sudo; systemctl status systemd-journald +systemd-journald.service - Journal Service + Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static) + Active: active (running) since Tue 2025-10-21 00:00:00 CET; 21 min ago +TriggeredBy: systemd-journald-audit.socket + systemd-journald.socket + systemd-journald-audit.dev-log.socket + Docs: man:systemd-journald.service(8) + man:journald.conf(5) + Main PID: 624 (systemd-journal) + Tasks: 1 + FD Store: 8 (limit:4224) + CPU:116ms + CGroup: /system.slice/systemd-journald.service + └─413 /usr/lib/systemd/systemd-journald +[...] + The journal records nearly every type of event generated on the system, including Kernel messages, Initrd (initial RAM disk) messages, Service startup/shutdown, Application events, and Authentication and session data. + Journal allows centralization and unification of logs from all sources, and it records events in structured manner which in turn helps identifying errors and in crash recovery. + journald collects log data from several sources simultaneously logs are then managed in a structured, binary format within files in /run/log/journal/ by default. Because the /run/ directory is volatile by nature, log data is lost at reboot. To make the log data persistent, create the directory /var/log/journal/ and make sure it has the correct access modes and ownership, so the systemd-journald service can store its data. To switch to persistent logging, execute the following commands: + Hence, all log data stored in /run/log/journal/ are flushed into /var/log/journal/. + sudo mkdir /var/log/journal +sudo systemd-tmpfiles --create --prefix=/var/log/journal +sudo journalctl --flush +
Journal entry structure + Log entry in the journal is a data structure containing the log message and numerous metadata fields, such as time stamp, source fields, systemd fields, kernel fields, and priority level. +Timestamp: The exact time the event occurred. +Source Fields + + _PID: Process ID of the sender. + _UID/_GID: User/Group ID of the sender. + _EXE: Path to the executable. + _COMM: Name of the executable. + + +System Fields + + _SYSTEMD_UNIT: The systemd unit (service) that generated the log (e.g., sshd.service). + _BOOT_ID: A unique identifier for the specific system boot session. + + +Kernel Fields + + _TRANSPORT: How the message was logged (e.g., kernel, syslog, stdout). + +Priority level: A numeric value indicating the severity of the message (0=emerg, 7=debug). + +
+ + <command>journalctl</command> usage + + + Running the journalctl command without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. + +Listed below are the common useful options to enhance the default journalctl behavior. All switches are described in the journalctl man page, man 1 journalctl. + + Messages related to a specific executable + + To show all journal messages related to a specific executable, specify the + full path to the executable: + +&prompt.sudo;journalctl /usr/lib/systemd/systemd + + + + + -f + + + Shows only the most recent journal messages, and prints new log entries + as they are added to the journal. + + + + + + + + Prints the messages and jumps to the end of the journal, so that the + latest entries are visible within the pager. + + + + + -r + + + Prints the messages of the journal in reverse order, so that the latest + entries are listed first. + + + + + -k + + + Shows only kernel messages. This is equivalent to the field match + _TRANSPORT=kernel (see + ). + + + + + -u + + + Shows only messages for the specified &systemd; unit. This is equivalent + to the field match + _SYSTEMD_UNIT=UNIT (see + ). + +&prompt.sudo;journalctl -u apache2 +[...] +Jun 03 10:07:11 pinkiepie systemd[1]: Starting The Apache Webserver... +Jun 03 10:07:12 pinkiepie systemd[1]: Started The Apache Webserver. + + + + + + + Filtering the journal output + + + When called without switches, journalctl shows the full + content of the journal, the oldest entries listed first. The output can be + filtered by specific switches and fields. + + + + Filtering based on a boot number + + journalctl can filter messages based on a specific + system boot. To list all available boots, run + +&prompt.sudo;journalctl --list-boots +-1 097ed2cd99124a2391d2cffab1b566f0 Mon 2014-05-26 08:36:56 EDT—Fri 2014-05-30 05:33:44 EDT + 0 156019a44a774a0bb0148a92df4af81b Fri 2014-05-30 05:34:09 EDT—Fri 2014-05-30 06:15:01 EDT + + The first column lists the boot offset: 0 for the + current boot, -1 for the previous one, + -2 for the one before that, etc. The second column + contains the boot ID followed by the limiting time stamps of the specific + boot. + + + Show all messages from the current boot: + +&prompt.sudo;journalctl -b + + If you need to see journal messages from the previous boot, add an offset + parameter. The following example outputs the previous boot messages: + +&prompt.sudo;journalctl -b -1 + + Another way is to list boot messages based on the boot ID. For this + purpose, use the _BOOT_ID field: + +&prompt.sudo;journalctl _BOOT_ID=156019a44a774a0bb0148a92df4af81b + + + + Filtering based on time interval + + You can filter the output of journalctl by specifying the + starting and/or ending date. The date specification should be of the format + 2014-06-30 9:17:16. If the time part is omitted, midnight + is assumed. If seconds are omitted, :00 is assumed. If + the date part is omitted, the current day is assumed. Instead of numeric + expression, you can specify the keywords yesterday, + today or tomorrow. They refer to + midnight of the day before the current day, of the current day, or of the + day after the current day. If you specify now, it refers + to the current time. You can also specify relative times prefixed with + - or +, referring to times before or + after the current time. + + + Show only new messages since now, and update the output continuously: + +&prompt.sudo;journalctl --since "now" -f + + Show all messages since last midnight till 3:20am: + +&prompt.sudo;journalctl --since "today" --until "3:20" + + + + Filtering based on fields + + You can filter the output of the journal by specific fields. The syntax of + a field to be matched is FIELD_NAME=MATCHED_VALUE, such + as _SYSTEMD_UNIT=httpd.service. You can specify multiple + matches in a single query to filter the output messages even more. See + man 7 systemd.journal-fields for a list of default + fields. + + + Show messages produced by a specific process ID: + +&prompt.sudo;journalctl _PID=1039 + + Show messages belonging to a specific user ID: + +# journalctl _UID=1000 + + Show messages from the kernel ring buffer (the same as + dmesg produces): + +&prompt.sudo;journalctl _TRANSPORT=kernel + + Show messages from the service's standard or error output: + +&prompt.sudo;journalctl _TRANSPORT=stdout + + Show messages produced by a specified service only: + +&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service + + If two different fields are specified, only entries that match both + expressions at the same time are shown: + +&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=1488 + + If two matches refer to the same field, all entries matching either + expression are shown: + +&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service + + You can use the + separator to combine two expressions in + a logical OR. The following example shows all messages + from the Avahi service process with the process ID 1480 together with all + messages from the D-Bus service: + +&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=1480 + _SYSTEMD_UNIT=dbus.service + + + Investigating &systemd; errors + + + This section introduces a simple example to illustrate how to find and fix + the error reported by &systemd; during apache2 start-up. + + + + + + Try to start the apache2 service: + +# systemctl start apache2 +Job for apache2.service failed. See 'systemctl status apache2' and 'journalctl -xn' for details. + + + + Let us see what the service's status says: + +&prompt.sudo;systemctl status apache2 +apache2.service - The Apache Webserver + Loaded: loaded (/usr/lib/systemd/system/apache2.service; disabled) + Active: failed (Result: exit-code) since Tue 2014-06-03 11:08:13 CEST; 7min ago + Process: 11026 ExecStop=/usr/sbin/start_apache2 -D SYSTEMD -DFOREGROUND \ + -k graceful-stop (code=exited, status=1/FAILURE) + + The ID of the process causing the failure is 11026. + + + + + Show the verbose version of messages related to process ID 11026: + +&prompt.sudo;journalctl -o verbose _PID=11026 +[...] +MESSAGE=AH00526: Syntax error on line 6 of /etc/apache2/default-server.conf: +[...] +MESSAGE=Invalid command 'DocumenttRoot', perhaps misspelled or defined by a module +[...] + + + + Fix the typo inside /etc/apache2/default-server.conf, + start the apache2 service, and print its status: + +&prompt.sudo;systemctl start apache2 && systemctl status apache2 +apache2.service - The Apache Webserver + Loaded: loaded (/usr/lib/systemd/system/apache2.service; disabled) + Active: active (running) since Tue 2014-06-03 11:26:24 CEST; 4ms ago + Process: 11026 ExecStop=/usr/sbin/start_apache2 -D SYSTEMD -DFOREGROUND + -k graceful-stop (code=exited, status=1/FAILURE) + Main PID: 11263 (httpd2-prefork) + Status: "Processing requests..." + CGroup: /system.slice/apache2.service + ├─11263 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -D [...] + ├─11280 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -D [...] + ├─11281 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -D [...] + ├─11282 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -D [...] + ├─11283 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -D [...] + └─11285 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -D [...] + + + + +

21.5 Journald configuration

  

+ The behavior of the systemd-journald service can be adjusted by modifying + /etc/systemd/journald.conf. This section introduces + only basic option settings. For a complete file description, see + man 5 journald.conf. You need to restart the journal for + the changes to take effect with + 

> sudo systemctl restart systemd-journald

21.5.1 Changing the journal size limit

  

+ If the journal log data is saved to a persistent location (see + Section 21.1, “Making the journal persistent”), it uses up to 10% of the file + system the /var/log/journal resides on. For example, + if /var/log/journal is located on a 30 GB + /var partition, the journal may use up to 3 GB of + the disk space. To change this limit, change (and uncomment) the + SystemMaxUse option: + 

SystemMaxUse=50M

21.5.2 Forwarding the journal to /dev/ttyX

  

+ You can forward the journal to a terminal device to inform you about system + messages on a preferred terminal screen, for example, + /dev/tty12. Change the following journald options to + 

ForwardToConsole=yes
+TTYPath=/dev/tty12

21.5.3 Forwarding the journal to syslog facility

  

+ Journald is backward compatible with traditional syslog implementations + such as rsyslog. Make sure the following is valid: +

  • + rsyslog is installed. + 

    > sudo rpm -q rsyslog
+rsyslog-7.4.8-2.16.x86_64

  • + rsyslog service is enabled. + 

    > sudo systemctl is-enabled rsyslog
+enabled

  • + Forwarding to syslog is enabled in + /etc/systemd/journald.conf. + 

    ForwardToSyslog=yes
+
+ From 71350c4912c3a606e5f68eb363a29a8b02a8e73a Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Mon, 24 Nov 2025 11:17:14 +0530 Subject: [PATCH 03/32] Updated. --- concepts/journal-about-journald.xml | 34 +---------------------------- 1 file changed, 1 insertion(+), 33 deletions(-) diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index 1c2b50e64..5c4d0e605 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -327,37 +327,5 @@ apache2.service - The Apache Webserver -

21.5 Journald configuration

  

- The behavior of the systemd-journald service can be adjusted by modifying - /etc/systemd/journald.conf. This section introduces - only basic option settings. For a complete file description, see - man 5 journald.conf. You need to restart the journal for - the changes to take effect with - 

> sudo systemctl restart systemd-journald

21.5.1 Changing the journal size limit

  

- If the journal log data is saved to a persistent location (see - Section 21.1, “Making the journal persistent”), it uses up to 10% of the file - system the /var/log/journal resides on. For example, - if /var/log/journal is located on a 30 GB - /var partition, the journal may use up to 3 GB of - the disk space. To change this limit, change (and uncomment) the - SystemMaxUse option: - 

SystemMaxUse=50M

21.5.2 Forwarding the journal to /dev/ttyX

  

- You can forward the journal to a terminal device to inform you about system - messages on a preferred terminal screen, for example, - /dev/tty12. Change the following journald options to - 

ForwardToConsole=yes
-TTYPath=/dev/tty12

21.5.3 Forwarding the journal to syslog facility

  

- Journald is backward compatible with traditional syslog implementations - such as rsyslog. Make sure the following is valid: -

  • - rsyslog is installed. - 

    > sudo rpm -q rsyslog
-rsyslog-7.4.8-2.16.x86_64

  • - rsyslog service is enabled. - 

    > sudo systemctl is-enabled rsyslog
-enabled

  • - Forwarding to syslog is enabled in - /etc/systemd/journald.conf. - 

    ForwardToSyslog=yes
-
+ From ab3205da6ea882f00371cef98266442467dfdfe9 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Mon, 24 Nov 2025 11:48:54 +0530 Subject: [PATCH 04/32] Fixed errors. --- articles/journalctl.asm.xml | 7 ++-- tasks/journald-configure.xml | 71 ++++++++++++++++++++++++++++++++++++ 2 files changed, 75 insertions(+), 3 deletions(-) create mode 100644 tasks/journald-configure.xml diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml index f0e22f723..e74e460c5 100644 --- a/articles/journalctl.asm.xml +++ b/articles/journalctl.asm.xml @@ -17,9 +17,9 @@ xmlns="http://docbook.org/ns/docbook"> - + + + + + + + + + Configuring journald + + + + + The topic covers the basic configuration of journald. You can configure the basic behavior of systemd-journald service by modifying /etc/systemd/journald.conf. After making the changes, you must restart systemd-journald. For more information on file description, see man 5 journald.conf.. + + + + + To configure journald, proceed as follows: + + + + + To modify the storage type, modify Storage=auto. + The available options are: + + volatile: RAM only (clears on reboot). + persistent: stored in /var/log/journal. + auto: persistent if directory exists, otherwise volatile. + none: no logs written to disk or memory. + + If the journal log data is saved to a persistent location, it uses up to 10% of the file system the /var/log/journal resides on. For example, if /var/log/journal is located on a 30 GB /var partition, the journal may use up to 3 GB of the disk space. To change this limit, change (and uncomment) the SystemMaxUse option: + SystemMaxUse=50M + systemctl restart systemd-journald + + + + + To limit logs rate to prevent flooding logs: + + RateLimitIntervalSec=30s +RateLimitBurst=1000 + + + + To send the journal to a terminal device to inform you about system messages on a preferred terminal screen, for example /dev/tty12: + + ForwardToConsole=yes +TTYPath=/dev/tty12 + + + To forward logs to syslog, modify ForwardToSyslog=yes.Journald is backward compatible with traditional syslog implementations such as rsyslog. + + Install rsyslogrpm -q rsyslog + Enable rsyslogsystemctl is-enabled rsyslog + Enable forwarding to rsyslog in in /etc/systemd/journald.confForwardToSyslog=yes + + + + From 29a9c4409924bbda455389b2ddfbe2578b3b83ae Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Mon, 24 Nov 2025 11:54:15 +0530 Subject: [PATCH 05/32] Fixed errors. --- tasks/systemd-journald-troubleshooting.xml | 86 ++++++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 tasks/systemd-journald-troubleshooting.xml diff --git a/tasks/systemd-journald-troubleshooting.xml b/tasks/systemd-journald-troubleshooting.xml new file mode 100644 index 000000000..4a25bfeb5 --- /dev/null +++ b/tasks/systemd-journald-troubleshooting.xml @@ -0,0 +1,86 @@ + + + %entities; +]> + + + + + + + Troubleshooting &systemd; errors + + + + + This section introduces a simple example to illustrate how to find and fix + the error reported by &systemd; during apache2 start-up. + + + + + + + Try to start the apache2 service: + +# systemctl start apache2 +Job for apache2.service failed. See 'systemctl status apache2' and 'journalctl -xn' for details. + + + + Let us see what the service's status says: + +&prompt.sudo;systemctl status apache2 +apache2.service - The Apache Webserver + Loaded: loaded (/usr/lib/systemd/system/apache2.service; disabled) + Active: failed (Result: exit-code) since Tue 2014-06-03 11:08:13 CEST; 7min ago + Process: 11026 ExecStop=/usr/sbin/start_apache2 -D SYSTEMD -DFOREGROUND \ + -k graceful-stop (code=exited, status=1/FAILURE) + + The ID of the process causing the failure is 11026. + + + + + Show the verbose version of messages related to process ID 11026: + +&prompt.sudo;journalctl -o verbose _PID=11026 +[...] +MESSAGE=AH00526: Syntax error on line 6 of /etc/apache2/default-server.conf: +[...] +MESSAGE=Invalid command 'DocumenttRoot', perhaps misspelled or defined by a module +[...] + + + + Fix the typo inside /etc/apache2/default-server.conf, + start the apache2 service, and print its status: + +&prompt.sudo;systemctl start apache2 && systemctl status apache2 +apache2.service - The Apache Webserver + Loaded: loaded (/usr/lib/systemd/system/apache2.service; disabled) + Active: active (running) since Tue 2014-06-03 11:26:24 CEST; 4ms ago + Process: 11026 ExecStop=/usr/sbin/start_apache2 -D SYSTEMD -DFOREGROUND + -k graceful-stop (code=exited, status=1/FAILURE) + Main PID: 11263 (httpd2-prefork) + Status: "Processing requests..." + CGroup: /system.slice/apache2.service + ├─11263 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -D [...] + ├─11280 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -D [...] + ├─11281 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -D [...] + ├─11282 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -D [...] + ├─11283 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -D [...] + └─11285 /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf -D [...] + + + + From 70e8f7ccdecc5467d3f217e45e2c7cb59397e064 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Mon, 24 Nov 2025 12:25:27 +0530 Subject: [PATCH 06/32] Fixed errors. --- tasks/systemd-journald-troubleshooting.xml | 31 +++++++++++++++++++--- 1 file changed, 27 insertions(+), 4 deletions(-) diff --git a/tasks/systemd-journald-troubleshooting.xml b/tasks/systemd-journald-troubleshooting.xml index 4a25bfeb5..a383e16c1 100644 --- a/tasks/systemd-journald-troubleshooting.xml +++ b/tasks/systemd-journald-troubleshooting.xml @@ -22,13 +22,35 @@ in the assembly --> - This section introduces a simple example to illustrate how to find and fix - the error reported by &systemd; during apache2 start-up. + This section introduces ways to interpret and fix the log messages retrieved through journalctl. - + +Identify the severity and content of the error.The errors are marked with priority level: +0-2: emerg, alert, crit: Critical issues, system collapse imminent. + 3: err (Error): A service or application failed to complete a requested operation. + 4: warning : Something undesirable happened but is not an immediate failure. + 5-7: notice, info, debug: Normal operational information and developer diagnostics. + +Identify the failing unit using the following command: +journalctl -u failing_service_name +The lines preceding the termination message includes information on the error. +Exit Status: f a service stops, look for a message like Process xxx exited with status 1/FAILURE. A status of 0 is success. Any non-zero status indicates an error. + Configuration Errors: Messages containing phrases like No such file or directory, Permission denied, or Address already in use usually point to a problem in the service's configuration file + Out-of-Memory (OOM): Out-of-Memory (OOM) + +Use detailed views of logs to get detailed information on the error. +journalctl -xe +To view all messages from the Apache service during the current boot, with detailed explanations, run the following command: +journalctl -u httpd.service -b -xe + +
- + + This section introduces a simple example to illustrate how to find and fix + the error reported by &systemd; during apache2 start-up. + + Try to start the apache2 service: @@ -83,4 +105,5 @@ apache2.service - The Apache Webserver +
From f7a11bf054503b4f2d6f0a88c39455214ecbde15 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Mon, 24 Nov 2025 12:28:40 +0530 Subject: [PATCH 07/32] Fixed errors. --- articles/journalctl.asm.xml | 3 +- concepts/journal-about-journald.xml | 66 +---------------------------- 2 files changed, 3 insertions(+), 66 deletions(-) diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml index e74e460c5..8daa4c5ee 100644 --- a/articles/journalctl.asm.xml +++ b/articles/journalctl.asm.xml @@ -19,7 +19,7 @@ xmlns="http://docbook.org/ns/docbook"> - + +--> + @@ -33,11 +33,11 @@ xmlns="http://docbook.org/ns/docbook"> GNU Free Documentation License - + -Viewing logs using &journalctl; +Viewing logs using <command>journalctl</command> - + 2025-09-10 @@ -62,11 +62,11 @@ Initial version &sleha; -View logs using &journalctl; +View logs using journalctl -How to view and manage &productnameshort; logs using &journalctl; +How to view and manage &productnameshort; logs using journalctl -View &productnameshort; logs using &journalctl; +View &productnameshort; logs using journalctl Configuration @@ -97,7 +97,7 @@ How to view and manage &productnameshort; logs using &journalctl; WHAT? -You can view and analyze logs from &systemd-journald; using the &journalctl; command-line tool. +You can view and analyze logs from systemd-journald using the journalctl command-line tool. @@ -106,7 +106,7 @@ You can view and analyze logs from &systemd-journald; using the &journalctl; com This article is intended to provide a complete overview of -tasks that can be performed using the &journalctl; command-line tool. +tasks that can be performed using the journalctl command-line tool. @@ -122,7 +122,7 @@ The average reading time of this article is approximately 30 minutes. GOAL -You will be able to view your system logs using &journalctl;. +You will be able to view your system logs using journalctl. @@ -130,26 +130,19 @@ You will be able to view your system logs using &journalctl;. REQUIREMENTS -To fully view the system-wide logs such as kernel, system services, or other user logs using &journaltl; command-line tool, you must have +To fully view the system-wide logs such as kernel, system services, or other user logs using journalctl command-line tool, you must have &sudo; privileges. -The &systemd-journald; service must be running as it collects the logs. +The systemd-journald service must be running as it collects the logs. For persistent logs across reboots, var/log/journal file must be available. Volatile logs are saved in /run/log/journal - - - - - - -You can view &systemd; logs using journalctl. - - - + + + diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index ac79bcb8f..01b5b75f1 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -25,32 +25,16 @@ - The systemd-journald service is enabled by default. + The systemd-journald service is enabled by default. - &prompt.sudo; systemctl status systemd-journald -systemd-journald.service - Journal Service - Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static) - Active: active (running) since Tue 2025-10-21 00:00:00 CET; 21 min ago -TriggeredBy: systemd-journald-audit.socket - systemd-journald.socket - systemd-journald-audit.dev-log.socket - Docs: man:systemd-journald.service(8) - man:journald.conf(5) - Main PID: 624 (systemd-journal) - Tasks: 1 - FD Store: 8 (limit:4224) - CPU:116ms - CGroup: /system.slice/systemd-journald.service - └─413 /usr/lib/systemd/systemd-journald -[...] - The journal records nearly every type of event generated on the system, including Kernel messages, Initrd (initial RAM disk) messages, Service startup/shutdown, Application events, and Authentication and session data. - Journal allows centralization and unification of logs from all sources, and it records events in structured manner which in turn helps identifying errors and in crash recovery. - journald collects log data from several sources simultaneously logs are then managed in a structured, binary format within files in /run/log/journal/ by default. Because the /run/ directory is volatile by nature, log data is lost at reboot. To make the log data persistent, create the directory /var/log/journal/ and make sure it has the correct access modes and ownership, so the systemd-journald service can store its data. To switch to persistent logging, execute the following commands: - Hence, all log data stored in /run/log/journal/ are flushed into /var/log/journal/. - sudo mkdir /var/log/journal + The journal records nearly every type of event generated on the system, including Kernel messages, Initrd (initial RAM disk) messages, Service startup/shutdown, Application events, and Authentication and session data. Journal allows centralization and unification of logs from all sources, and it records events in structured manner which in turn helps identifying errors and in crash recovery. + The journald command collects log data from several sources simultaneously logs are then managed in a structured, binary format within files in /run/log/journal/ by default. Because the /run/ directory is volatile by nature, log data is lost at reboot. To make the log data persistent, create the directory /var/log/journal/ and make sure it has the correct access modes and ownership, so the systemd-journald service can store its data. To switch to persistent logging, execute the following commands: + &prompt.sudo; mkdir /var/log/journal sudo systemd-tmpfiles --create --prefix=/var/log/journal sudo journalctl --flush -
Journal entry structure +All log data stored in /run/log/journal/ are flushed into /var/log/journal/. +
+ Journal entry structure Log entry in the journal is a data structure containing the log message and numerous metadata fields, such as time stamp, source fields, systemd fields, kernel fields, and priority level. Timestamp: The exact time the event occurred. Source Fields @@ -74,11 +58,11 @@ sudo journalctl --flush Priority level: A numeric value indicating the severity of the message (0=emerg, 7=debug).
- +
<command>journalctl</command> usage - Running the journalctl command without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. + Running the journalctl without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. Listed below are the common useful options to enhance the default journalctl behavior. All switches are described in the journalctl man page, man 1 journalctl. @@ -145,8 +129,8 @@ Jun 03 10:07:12 pinkiepie systemd[1]: Started The Apache Webserver. - - +
+
Filtering the journal output @@ -155,7 +139,7 @@ Jun 03 10:07:12 pinkiepie systemd[1]: Started The Apache Webserver. filtered by specific switches and fields. - +
Filtering based on a boot number journalctl can filter messages based on a specific @@ -185,9 +169,9 @@ Jun 03 10:07:12 pinkiepie systemd[1]: Started The Apache Webserver. purpose, use the _BOOT_ID field: &prompt.sudo;journalctl _BOOT_ID=156019a44a774a0bb0148a92df4af81b - +
- +
Filtering based on time interval You can filter the output of journalctl by specifying the @@ -211,9 +195,8 @@ Jun 03 10:07:12 pinkiepie systemd[1]: Started The Apache Webserver. Show all messages since last midnight till 3:20am: &prompt.sudo;journalctl --since "today" --until "3:20" - - - +
+
Filtering based on fields You can filter the output of the journal by specific fields. The syntax of @@ -233,7 +216,7 @@ Jun 03 10:07:12 pinkiepie systemd[1]: Started The Apache Webserver. # journalctl _UID=1000 Show messages from the kernel ring buffer (the same as - dmesg produces): + dmesg displays): &prompt.sudo;journalctl _TRANSPORT=kernel @@ -261,7 +244,6 @@ Jun 03 10:07:12 pinkiepie systemd[1]: Started The Apache Webserver. messages from the D-Bus service: &prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=1480 + _SYSTEMD_UNIT=dbus.service - - - +
+
diff --git a/tasks/journald-configure.xml b/tasks/journald-configure.xml index 9b00e086e..4e7bb0f8b 100644 --- a/tasks/journald-configure.xml +++ b/tasks/journald-configure.xml @@ -35,10 +35,10 @@ in the assembly --> To modify the storage type, modify Storage=auto. The available options are: - volatile: RAM only (clears on reboot). - persistent: stored in /var/log/journal. - auto: persistent if directory exists, otherwise volatile. - none: no logs written to disk or memory. + volatile: RAM only (clears on reboot). + persistent: stored in /var/log/journal. + auto: persistent if directory exists, otherwise volatile. + none: no logs written to disk or memory. If the journal log data is saved to a persistent location, it uses up to 10% of the file system the /var/log/journal resides on. For example, if /var/log/journal is located on a 30 GB /var partition, the journal may use up to 3 GB of the disk space. To change this limit, change (and uncomment) the SystemMaxUse option: SystemMaxUse=50M diff --git a/tasks/systemd-journald-troubleshooting.xml b/tasks/systemd-journald-troubleshooting.xml index a383e16c1..03de90670 100644 --- a/tasks/systemd-journald-troubleshooting.xml +++ b/tasks/systemd-journald-troubleshooting.xml @@ -26,14 +26,16 @@ in the assembly --> -Identify the severity and content of the error.The errors are marked with priority level: + + Troubleshoot <command>journalctl</command> errors + Identify the severity and content of the error.The errors are marked with priority level: 0-2: emerg, alert, crit: Critical issues, system collapse imminent. 3: err (Error): A service or application failed to complete a requested operation. 4: warning : Something undesirable happened but is not an immediate failure. 5-7: notice, info, debug: Normal operational information and developer diagnostics. - + Identify the failing unit using the following command: -journalctl -u failing_service_name +journalctl -u <failing_service_name> The lines preceding the termination message includes information on the error. Exit Status: f a service stops, look for a message like Process xxx exited with status 1/FAILURE. A status of 0 is success. Any non-zero status indicates an error. Configuration Errors: Messages containing phrases like No such file or directory, Permission denied, or Address already in use usually point to a problem in the service's configuration file @@ -44,9 +46,11 @@ in the assembly --> To view all messages from the Apache service during the current boot, with detailed explanations, run the following command: journalctl -u httpd.service -b -xe +
+ Troubleshoot apache error - + This section introduces a simple example to illustrate how to find and fix the error reported by &systemd; during apache2 start-up. From 069b734d2ee061a7ec5dfd3fef313369dd0f1f82 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Mon, 24 Nov 2025 13:16:50 +0530 Subject: [PATCH 09/32] Fixed errors. --- concepts/journal-about-journald.xml | 2 +- tasks/journald-configure.xml | 7 ++++--- tasks/systemd-journald-troubleshooting.xml | 3 +-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index 01b5b75f1..657ef3613 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -20,7 +20,7 @@ - systemd uses journald as its logging system. All system events are written to the journal, a system service managed by systemd-journald.service (journald). This allows you to search and manage all system logs. It collects and stores logging data by maintaining structured indexed journals based on logging information received from the kernel, user processes, standard input, and system service errors. + systemd uses journald as its logging system. All system events are written to the journal, a system service managed by systemd-journald service. This allows you to search and manage all system logs. It collects and stores logging data by maintaining structured indexed journals based on logging information received from the kernel, user processes, standard input, and system service errors. diff --git a/tasks/journald-configure.xml b/tasks/journald-configure.xml index 4e7bb0f8b..f79f54626 100644 --- a/tasks/journald-configure.xml +++ b/tasks/journald-configure.xml @@ -22,7 +22,7 @@ in the assembly --> - The topic covers the basic configuration of journald. You can configure the basic behavior of systemd-journald service by modifying /etc/systemd/journald.conf. After making the changes, you must restart systemd-journald. For more information on file description, see man 5 journald.conf.. + The topic covers the basic configuration of journald. You can configure the basic behavior of systemd-journald service by modifying /etc/systemd/journald.conf. After making the changes, you must restart systemd-journald. For more information on file description, see man 5 journald.conf.. @@ -41,8 +41,9 @@ in the assembly --> none: no logs written to disk or memory. If the journal log data is saved to a persistent location, it uses up to 10% of the file system the /var/log/journal resides on. For example, if /var/log/journal is located on a 30 GB /var partition, the journal may use up to 3 GB of the disk space. To change this limit, change (and uncomment) the SystemMaxUse option: - SystemMaxUse=50M - systemctl restart systemd-journald + + SystemMaxUse=50M +systemctl restart systemd-journald diff --git a/tasks/systemd-journald-troubleshooting.xml b/tasks/systemd-journald-troubleshooting.xml index 03de90670..947dbad35 100644 --- a/tasks/systemd-journald-troubleshooting.xml +++ b/tasks/systemd-journald-troubleshooting.xml @@ -45,10 +45,9 @@ in the assembly --> journalctl -xe To view all messages from the Apache service during the current boot, with detailed explanations, run the following command: journalctl -u httpd.service -b -xe -
- Troubleshoot apache error + Troubleshoot apache2 error This section introduces a simple example to illustrate how to find and fix From 54375550203a4553032351b760992f06b132e551 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Mon, 24 Nov 2025 13:18:22 +0530 Subject: [PATCH 10/32] Fixed errors. --- articles/journalctl.asm.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml index 89e5060f7..fc4150374 100644 --- a/articles/journalctl.asm.xml +++ b/articles/journalctl.asm.xml @@ -35,7 +35,7 @@ xmlns="http://docbook.org/ns/docbook"> -Viewing logs using <command>journalctl</command> +Viewing <command>systemd-journald</command> logs using <command>journalctl</command> 2025-09-10 From acd67209457cf1d083e4be106e396c1e4d50d1ad Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Mon, 24 Nov 2025 13:20:05 +0530 Subject: [PATCH 11/32] Fixed errors. --- concepts/journal-about-journald.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index 657ef3613..ce899b771 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -30,8 +30,8 @@ The journal records nearly every type of event generated on the system, including Kernel messages, Initrd (initial RAM disk) messages, Service startup/shutdown, Application events, and Authentication and session data. Journal allows centralization and unification of logs from all sources, and it records events in structured manner which in turn helps identifying errors and in crash recovery. The journald command collects log data from several sources simultaneously logs are then managed in a structured, binary format within files in /run/log/journal/ by default. Because the /run/ directory is volatile by nature, log data is lost at reboot. To make the log data persistent, create the directory /var/log/journal/ and make sure it has the correct access modes and ownership, so the systemd-journald service can store its data. To switch to persistent logging, execute the following commands: &prompt.sudo; mkdir /var/log/journal -sudo systemd-tmpfiles --create --prefix=/var/log/journal -sudo journalctl --flush +&prompt.sudo; systemd-tmpfiles --create --prefix=/var/log/journal +&prompt.sudo; journalctl --flush All log data stored in /run/log/journal/ are flushed into /var/log/journal/.
Journal entry structure From 1f6a9879772a5b61bcb3b803ef7dd7336232fd17 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Mon, 24 Nov 2025 13:22:07 +0530 Subject: [PATCH 12/32] Fixed errors. --- concepts/journal-about-journald.xml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index ce899b771..d095540a6 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -121,10 +121,7 @@ _SYSTEMD_UNIT=UNIT (see ). -&prompt.sudo;journalctl -u apache2 -[...] -Jun 03 10:07:11 pinkiepie systemd[1]: Starting The Apache Webserver... -Jun 03 10:07:12 pinkiepie systemd[1]: Started The Apache Webserver. +&prompt.sudo;journalctl -u apache2 From c8d1128e9d8b803160fba16962e097648e497d38 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Mon, 24 Nov 2025 13:26:49 +0530 Subject: [PATCH 13/32] Fixed errors. --- concepts/journal-about-journald.xml | 6 ++---- tasks/systemd-journald-troubleshooting.xml | 4 ++-- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index d095540a6..16706236a 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -142,9 +142,7 @@ journalctl can filter messages based on a specific system boot. To list all available boots, run -&prompt.sudo;journalctl --list-boots --1 097ed2cd99124a2391d2cffab1b566f0 Mon 2014-05-26 08:36:56 EDT—Fri 2014-05-30 05:33:44 EDT - 0 156019a44a774a0bb0148a92df4af81b Fri 2014-05-30 05:34:09 EDT—Fri 2014-05-30 06:15:01 EDT +&prompt.sudo;journalctl --list-boots The first column lists the boot offset: 0 for the current boot, -1 for the previous one, @@ -173,7 +171,7 @@ You can filter the output of journalctl by specifying the starting and/or ending date. The date specification should be of the format - 2014-06-30 9:17:16. If the time part is omitted, midnight + 2025-06-30 9:17:16. If the time part is omitted, midnight is assumed. If seconds are omitted, :00 is assumed. If the date part is omitted, the current day is assumed. Instead of numeric expression, you can specify the keywords yesterday, diff --git a/tasks/systemd-journald-troubleshooting.xml b/tasks/systemd-journald-troubleshooting.xml index 947dbad35..ff0b47542 100644 --- a/tasks/systemd-journald-troubleshooting.xml +++ b/tasks/systemd-journald-troubleshooting.xml @@ -67,7 +67,7 @@ Job for apache2.service failed. See 'systemctl status apache2' and 'journalctl - &prompt.sudo;systemctl status apache2 apache2.service - The Apache Webserver Loaded: loaded (/usr/lib/systemd/system/apache2.service; disabled) - Active: failed (Result: exit-code) since Tue 2014-06-03 11:08:13 CEST; 7min ago + Active: failed (Result: exit-code) since Tue 2025-09-03 11:08:13 EDT; 7min ago Process: 11026 ExecStop=/usr/sbin/start_apache2 -D SYSTEMD -DFOREGROUND \ -k graceful-stop (code=exited, status=1/FAILURE) @@ -93,7 +93,7 @@ MESSAGE=Invalid command 'DocumenttRoot', perhaps misspelled or defined by a modu &prompt.sudo;systemctl start apache2 && systemctl status apache2 apache2.service - The Apache Webserver Loaded: loaded (/usr/lib/systemd/system/apache2.service; disabled) - Active: active (running) since Tue 2014-06-03 11:26:24 CEST; 4ms ago + Active: active (running) since Tue 2025-09-03 11:26:24 EDT; 4ms ago Process: 11026 ExecStop=/usr/sbin/start_apache2 -D SYSTEMD -DFOREGROUND -k graceful-stop (code=exited, status=1/FAILURE) Main PID: 11263 (httpd2-prefork) From df14ed14861d6cec60d132c2b63b2b8faf51f46f Mon Sep 17 00:00:00 2001 From: Shalaka Harne <135588263+harneshalaka@users.noreply.github.com> Date: Wed, 26 Nov 2025 18:26:18 +0530 Subject: [PATCH 14/32] Apply suggestions from code review Co-authored-by: lvicoun --- articles/journalctl.asm.xml | 2 +- concepts/journal-about-journald.xml | 4 ++-- tasks/journald-configure.xml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml index fc4150374..1455da048 100644 --- a/articles/journalctl.asm.xml +++ b/articles/journalctl.asm.xml @@ -35,7 +35,7 @@ xmlns="http://docbook.org/ns/docbook"> -Viewing <command>systemd-journald</command> logs using <command>journalctl</command> +Mastering System Logs: From <command>systemd-journald</command> to <command>journalctl</command> 2025-09-10 diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index 16706236a..566e38688 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -35,7 +35,7 @@ All log data stored in /run/log/journal/ are flushed into /var/log/journal/.
Journal entry structure - Log entry in the journal is a data structure containing the log message and numerous metadata fields, such as time stamp, source fields, systemd fields, kernel fields, and priority level. + Log entry in the journal is a data structure containing the log message and metadata fields: Timestamp: The exact time the event occurred. Source Fields @@ -131,7 +131,7 @@ Filtering the journal output - When called without switches, journalctl shows the full + This section describes how to refine the search in logs according to boot numbers, for specific time interval or to view specific data fields. content of the journal, the oldest entries listed first. The output can be filtered by specific switches and fields. diff --git a/tasks/journald-configure.xml b/tasks/journald-configure.xml index f79f54626..0c82daddf 100644 --- a/tasks/journald-configure.xml +++ b/tasks/journald-configure.xml @@ -22,7 +22,7 @@ in the assembly --> - The topic covers the basic configuration of journald. You can configure the basic behavior of systemd-journald service by modifying /etc/systemd/journald.conf. After making the changes, you must restart systemd-journald. For more information on file description, see man 5 journald.conf.. + You can configure the basic behavior of systemd-journald service by modifying /etc/systemd/journald.conf. After making the changes, you must restart systemd-journald. . From a8351fcabf12717347ebcfccbad65a71c02c7e1f Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Wed, 26 Nov 2025 18:58:17 +0530 Subject: [PATCH 15/32] Fixed editorial comments. --- articles/journalctl.asm.xml | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml index 1455da048..a5cf42738 100644 --- a/articles/journalctl.asm.xml +++ b/articles/journalctl.asm.xml @@ -38,7 +38,7 @@ xmlns="http://docbook.org/ns/docbook"> Mastering System Logs: From <command>systemd-journald</command> to <command>journalctl</command> -2025-09-10 +2025-11-26 Initial version @@ -62,11 +62,11 @@ Initial version &sleha; -View logs using journalctl +Mastering System Logs: From systemd-journald to journalctl How to view and manage &productnameshort; logs using journalctl -View &productnameshort; logs using journalctl +Mastering System Logs: From systemd-journald to journalctl Configuration @@ -105,8 +105,7 @@ You can view and analyze logs from systemd-journald using the WHY? -This article is intended to provide a complete overview of -tasks that can be performed using the journalctl command-line tool. +This article is intended to provide a complete overview of tasks that can be performed using the journalctl command-line tool. @@ -130,11 +129,8 @@ You will be able to view your system logs using journalctl. REQUIREMENTS -To fully view the system-wide logs such as kernel, system services, or other user logs using journalctl command-line tool, you must have -&sudo; privileges. +You must have &sudo; privileges. -The systemd-journald service must be running as it collects the logs. -For persistent logs across reboots, var/log/journal file must be available. Volatile logs are saved in /run/log/journal From ab0a086c3ddad22eb55694c9108f20571735e7e4 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Thu, 27 Nov 2025 11:32:43 +0530 Subject: [PATCH 16/32] Updated. --- concepts/journal-about-journald.xml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index 566e38688..bfa73032c 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -20,14 +20,13 @@ - systemd uses journald as its logging system. All system events are written to the journal, a system service managed by systemd-journald service. This allows you to search and manage all system logs. It collects and stores logging data by maintaining structured indexed journals based on logging information received from the kernel, user processes, standard input, and system service errors. - + systemd uses journald as its logging system. The systemd-journald service is enabled by default. - The journal records nearly every type of event generated on the system, including Kernel messages, Initrd (initial RAM disk) messages, Service startup/shutdown, Application events, and Authentication and session data. Journal allows centralization and unification of logs from all sources, and it records events in structured manner which in turn helps identifying errors and in crash recovery. + All system events are written to the journal, a system service managed by systemd-journald service. This allows you to search and manage all system logs. It collects and stores logging data by maintaining structured indexed journals based on logging information received from the kernel, user processes, standard input, and system service errors. The journal records nearly every type of event generated on the system, including kernel messages, initrd (initial RAM disk) messages, service startup/shutdown, application events, and authentication and session data. Journal allows centralization and unification of logs from all sources, and it records events in structured manner which in turn helps identifying errors and in crash recovery. The journald command collects log data from several sources simultaneously logs are then managed in a structured, binary format within files in /run/log/journal/ by default. Because the /run/ directory is volatile by nature, log data is lost at reboot. To make the log data persistent, create the directory /var/log/journal/ and make sure it has the correct access modes and ownership, so the systemd-journald service can store its data. To switch to persistent logging, execute the following commands: &prompt.sudo; mkdir /var/log/journal &prompt.sudo; systemd-tmpfiles --create --prefix=/var/log/journal From 7718321a9c8875b97671c3374ea71e988342d537 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Thu, 27 Nov 2025 15:01:08 +0530 Subject: [PATCH 17/32] Fixed feedback. --- concepts/journal-about-journald.xml | 30 +++++++--- tasks/journald-configure.xml | 90 +++++++++++++++++++---------- 2 files changed, 82 insertions(+), 38 deletions(-) diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index bfa73032c..bc53fcf9f 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -20,21 +20,31 @@ - systemd uses journald as its logging system. - - + systemd uses journald as its logging system. The systemd-journald service is enabled by default. + All system events are written to the journal, a system service managed by systemd-journald service. This allows you to search and manage all system logs. It collects and stores logging data by maintaining structured indexed journals based on logging information received from the kernel, user processes, standard input, and system service errors. The journal records nearly every type of event generated on the system, including kernel messages, initrd (initial RAM disk) messages, service startup/shutdown, application events, and authentication and session data. Journal allows centralization and unification of logs from all sources, and it records events in structured manner which in turn helps identifying errors and in crash recovery. + journalctl is the command-line tool to view and analyze the logs from the systemd-journald service. + + +
+ <command>journalctl</command>: configuration and structure + - The systemd-journald service is enabled by default. + This section describes the journalctl location, configuring the location for persistent logs, and the journalctl entry structure. - All system events are written to the journal, a system service managed by systemd-journald service. This allows you to search and manage all system logs. It collects and stores logging data by maintaining structured indexed journals based on logging information received from the kernel, user processes, standard input, and system service errors. The journal records nearly every type of event generated on the system, including kernel messages, initrd (initial RAM disk) messages, service startup/shutdown, application events, and authentication and session data. Journal allows centralization and unification of logs from all sources, and it records events in structured manner which in turn helps identifying errors and in crash recovery. - The journald command collects log data from several sources simultaneously logs are then managed in a structured, binary format within files in /run/log/journal/ by default. Because the /run/ directory is volatile by nature, log data is lost at reboot. To make the log data persistent, create the directory /var/log/journal/ and make sure it has the correct access modes and ownership, so the systemd-journald service can store its data. To switch to persistent logging, execute the following commands: + +Verify the logs location: +&prompt.sudo; ls /var/log/journal +&prompt.sudo; ls /run/log/journal + + The journald command collects log data from several sources simultaneously logs and are then managed in a structured, binary format within files in /run/log/journal/ by default. Because the /run/ directory is volatile by nature, log data is lost at reboot. To make the log data persistent, create a directory /var/log/journal/ so the systemd-journald service can store its data. To switch to persistent logging across reboots, create /var/log/journal: &prompt.sudo; mkdir /var/log/journal &prompt.sudo; systemd-tmpfiles --create --prefix=/var/log/journal &prompt.sudo; journalctl --flush All log data stored in /run/log/journal/ are flushed into /var/log/journal/. -
- Journal entry structure - Log entry in the journal is a data structure containing the log message and metadata fields: + +View the journal entry structure: +&prompt.sudo; journalctl -n 1 -o verbose +Log entry in the journal is a data structure containing the log message and metadata fields: Timestamp: The exact time the event occurred. Source Fields @@ -56,6 +66,8 @@ Priority level: A numeric value indicating the severity of the message (0=emerg, 7=debug). + +
<command>journalctl</command> usage diff --git a/tasks/journald-configure.xml b/tasks/journald-configure.xml index 0c82daddf..29d5b1ab3 100644 --- a/tasks/journald-configure.xml +++ b/tasks/journald-configure.xml @@ -16,57 +16,89 @@ xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:trans="http://docbook.org/ns/transclusion"> - Configuring journald - You can configure the basic behavior of systemd-journald service by modifying /etc/systemd/journald.conf. After making the changes, you must restart systemd-journald. . - + You can configure the basic behavior of systemd-journald service by modifying /etc/systemd/journald.conf. - To configure journald, proceed as follows: + To configure systemd-journald, proceed as follows: + Configuring <command>systemd-journald</command> + Open the systemd-journald configuration file: +&prompt.sudo; vi /etc/systemd/journald.conf +[Journal] + +# Store journals on disk so logs survive reboot +Storage=persistent + +# Disk space limits +SystemMaxUse=2G +SystemKeepFree=10% + +# Per-file max size +SystemMaxFileSize=200M + +# RAM (runtime) journal limits +RuntimeMaxUse=500M +RuntimeKeepFree=10% + +# Log retention +MaxRetentionSec=4weeks + +# Compression for old logs +Compress=yes + +# Optional: also forward to rsyslog/syslog +ForwardToSyslog=yes + + + Modify the configurations: + + - To modify the storage type, modify Storage=auto. + To modify the storage type, modify Storage=auto. The available options are: volatile: RAM only (clears on reboot). - persistent: stored in /var/log/journal. - auto: persistent if directory exists, otherwise volatile. - none: no logs written to disk or memory. - - If the journal log data is saved to a persistent location, it uses up to 10% of the file system the /var/log/journal resides on. For example, if /var/log/journal is located on a 30 GB /var partition, the journal may use up to 3 GB of the disk space. To change this limit, change (and uncomment) the SystemMaxUse option: - - SystemMaxUse=50M -systemctl restart systemd-journald - - - - - To limit logs rate to prevent flooding logs: - + persistent: stored in /var/log/journal. + auto: persistent if directory exists, otherwise volatile. + none: no logs written to disk or memory. + + If the journal log data is saved to a persistent location, it uses up to 10% of the file system the /var/log/journal resides on. For example, if /var/log/journal is located on a 30 GB /var partition, the journal may use up to 3 GB of the disk space. To change this limit, change (and uncomment) the SystemMaxUse option: + SystemMaxUse=50M +&prompt.sudo; systemctl restart systemd-journald + + + To limit logs rate to prevent flooding logs: RateLimitIntervalSec=30s RateLimitBurst=1000 - - + + To send the journal to a terminal device to inform you about system messages on a preferred terminal screen, for example /dev/tty12: ForwardToConsole=yes TTYPath=/dev/tty12 - - + + To forward logs to syslog, modify ForwardToSyslog=yes.Journald is backward compatible with traditional syslog implementations such as rsyslog. - - Install rsyslogrpm -q rsyslog - Enable rsyslogsystemctl is-enabled rsyslog - Enable forwarding to rsyslog in in /etc/systemd/journald.confForwardToSyslog=yes - - + + Install rsyslogrpm -q rsyslog + Enable rsyslogsystemctl is-enabled rsyslog + Enable forwarding to rsyslog in in /etc/systemd/journald.confForwardToSyslog=yes + + + + + Save and restart systemd-journald. + &prompt.sudo; systemctl restart systemd-journald + From ae6297d9b11b147d04c4ec3b88e46c62e0ebe77b Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Thu, 27 Nov 2025 15:11:46 +0530 Subject: [PATCH 18/32] Fixed feedback. --- articles/journalctl.asm.xml | 7 +- concepts/journal-about-journald.xml | 69 ------------------- references/journalctl-usage.xml | 103 ++++++++++++++++++++++++++++ tasks/journald-configure.xml | 1 + 4 files changed, 108 insertions(+), 72 deletions(-) create mode 100644 references/journalctl-usage.xml diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml index a5cf42738..5f3e33f0d 100644 --- a/articles/journalctl.asm.xml +++ b/articles/journalctl.asm.xml @@ -20,9 +20,9 @@ xmlns="http://docbook.org/ns/docbook"> - + + + @@ -138,6 +138,7 @@ You must have &sudo; privileges. + diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index bc53fcf9f..ca2b5ca7d 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -68,75 +68,6 @@ -
-
- <command>journalctl</command> usage - - - Running the journalctl without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. - -Listed below are the common useful options to enhance the default journalctl behavior. All switches are described in the journalctl man page, man 1 journalctl. - - Messages related to a specific executable - - To show all journal messages related to a specific executable, specify the - full path to the executable: - -&prompt.sudo;journalctl /usr/lib/systemd/systemd - - - - - -f - - - Shows only the most recent journal messages, and prints new log entries - as they are added to the journal. - - - - - - - - Prints the messages and jumps to the end of the journal, so that the - latest entries are visible within the pager. - - - - - -r - - - Prints the messages of the journal in reverse order, so that the latest - entries are listed first. - - - - - -k - - - Shows only kernel messages. This is equivalent to the field match - _TRANSPORT=kernel (see - ). - - - - - -u - - - Shows only messages for the specified &systemd; unit. This is equivalent - to the field match - _SYSTEMD_UNIT=UNIT (see - ). - -&prompt.sudo;journalctl -u apache2 - - - -
Filtering the journal output diff --git a/references/journalctl-usage.xml b/references/journalctl-usage.xml new file mode 100644 index 000000000..3fb8fbceb --- /dev/null +++ b/references/journalctl-usage.xml @@ -0,0 +1,103 @@ + + + %entities; +]> + + + + + + + + + <command>journalctl</command> usage + + + Running the journalctl without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. + + + + + + + You can run the journalctl: + + +
+ Using <command>journalctl</command>sage + + + Running the journalctl without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. + +Listed below are the common useful options to enhance the default journalctl behavior. All switches are described in the journalctl man page, man 1 journalctl. + + Messages related to a specific executable + + To show all journal messages related to a specific executable, specify the + full path to the executable: + +&prompt.sudo;journalctl /usr/lib/systemd/systemd + + + + + -f + + + Shows only the most recent journal messages, and prints new log entries + as they are added to the journal. + + + + + + + + Prints the messages and jumps to the end of the journal, so that the + latest entries are visible within the pager. + + + + + -r + + + Prints the messages of the journal in reverse order, so that the latest + entries are listed first. + + + + + -k + + + Shows only kernel messages. This is equivalent to the field match + _TRANSPORT=kernel (see + ). + + + + + -u + + + Shows only messages for the specified &systemd; unit. This is equivalent + to the field match + _SYSTEMD_UNIT=UNIT (see + ). + +&prompt.sudo;journalctl -u apache2 + + + + +
+ diff --git a/tasks/journald-configure.xml b/tasks/journald-configure.xml index 29d5b1ab3..e173259f4 100644 --- a/tasks/journald-configure.xml +++ b/tasks/journald-configure.xml @@ -94,6 +94,7 @@ TTYPath=/dev/tty12 Enable rsyslogsystemctl is-enabled rsyslog Enable forwarding to rsyslog in in /etc/systemd/journald.confForwardToSyslog=yes + For more information on file description, see man 5 journald.conf. From f3f480eb5b9e1eaad20c8fef720da50b37141572 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Thu, 27 Nov 2025 15:18:53 +0530 Subject: [PATCH 19/32] Fixed errors. --- articles/journalctl.asm.xml | 2 +- concepts/journal-about-journald.xml | 3 +-- references/journalctl-usage.xml | 3 --- 3 files changed, 2 insertions(+), 6 deletions(-) diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml index 5f3e33f0d..1961184ea 100644 --- a/articles/journalctl.asm.xml +++ b/articles/journalctl.asm.xml @@ -138,7 +138,7 @@ You must have &sudo; privileges. - + diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index ca2b5ca7d..ff2c7397f 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -69,7 +69,7 @@
-
+
Filtering the journal output @@ -77,7 +77,6 @@ content of the journal, the oldest entries listed first. The output can be filtered by specific switches and fields. -
Filtering based on a boot number diff --git a/references/journalctl-usage.xml b/references/journalctl-usage.xml index 3fb8fbceb..548534a3a 100644 --- a/references/journalctl-usage.xml +++ b/references/journalctl-usage.xml @@ -30,10 +30,8 @@ You can run the journalctl: -
Using <command>journalctl</command>sage - Running the journalctl without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. @@ -46,7 +44,6 @@ &prompt.sudo;journalctl /usr/lib/systemd/systemd - -f From 8dcc2e714ba687dbdac7eddf7c1a2ef68f3abfac Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Fri, 28 Nov 2025 13:25:09 +0530 Subject: [PATCH 20/32] Moved contents from concept. --- tasks/journald-filter-journals.xml | 37 ++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 tasks/journald-filter-journals.xml diff --git a/tasks/journald-filter-journals.xml b/tasks/journald-filter-journals.xml new file mode 100644 index 000000000..1e74a32fb --- /dev/null +++ b/tasks/journald-filter-journals.xml @@ -0,0 +1,37 @@ + + + %entities; +]> + + + + + + + Filter the journal output + + + + + This section describes how to refine the search in logs according to boot numbers, for specific time interval or to view specific data fields. + content of the journal, the oldest entries listed first. The output can be + filtered by specific switches and fields. + + + + You can filter journals based on boot number, time interval, and fields. + + + Filtering journals + + + From c0bc7b5578a8803212b0b5d2975cc0543ed45b3c Mon Sep 17 00:00:00 2001 From: Shalaka Harne <135588263+harneshalaka@users.noreply.github.com> Date: Wed, 26 Nov 2025 18:26:18 +0530 Subject: [PATCH 21/32] Co-authored-by: lvicoun Fixed editorial comments. --- articles/journalctl.asm.xml | 23 +++--- concepts/journal-about-journald.xml | 105 ++++++---------------------- references/journalctl-usage.xml | 100 ++++++++++++++++++++++++++ tasks/journald-configure.xml | 91 ++++++++++++++++-------- tasks/journald-filter-journals.xml | 37 ++++++++++ 5 files changed, 232 insertions(+), 124 deletions(-) create mode 100644 references/journalctl-usage.xml create mode 100644 tasks/journald-filter-journals.xml diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml index fc4150374..1961184ea 100644 --- a/articles/journalctl.asm.xml +++ b/articles/journalctl.asm.xml @@ -20,9 +20,9 @@ xmlns="http://docbook.org/ns/docbook"> - + + + @@ -35,10 +35,10 @@ xmlns="http://docbook.org/ns/docbook"> -Viewing <command>systemd-journald</command> logs using <command>journalctl</command> +Mastering System Logs: From <command>systemd-journald</command> to <command>journalctl</command> -2025-09-10 +2025-11-26 Initial version @@ -62,11 +62,11 @@ Initial version &sleha; -View logs using journalctl +Mastering System Logs: From systemd-journald to journalctl How to view and manage &productnameshort; logs using journalctl -View &productnameshort; logs using journalctl +Mastering System Logs: From systemd-journald to journalctl Configuration @@ -105,8 +105,7 @@ You can view and analyze logs from systemd-journald using the WHY? -This article is intended to provide a complete overview of -tasks that can be performed using the journalctl command-line tool. +This article is intended to provide a complete overview of tasks that can be performed using the journalctl command-line tool. @@ -130,11 +129,8 @@ You will be able to view your system logs using journalctl. REQUIREMENTS -To fully view the system-wide logs such as kernel, system services, or other user logs using journalctl command-line tool, you must have -&sudo; privileges. +You must have &sudo; privileges. -The systemd-journald service must be running as it collects the logs. -For persistent logs across reboots, var/log/journal file must be available. Volatile logs are saved in /run/log/journal @@ -142,6 +138,7 @@ To fully view the system-wide logs such as kernel, system services, or other use + diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index 16706236a..ff2c7397f 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -20,22 +20,31 @@ - systemd uses journald as its logging system. All system events are written to the journal, a system service managed by systemd-journald service. This allows you to search and manage all system logs. It collects and stores logging data by maintaining structured indexed journals based on logging information received from the kernel, user processes, standard input, and system service errors. - - - + systemd uses journald as its logging system. The systemd-journald service is enabled by default. + All system events are written to the journal, a system service managed by systemd-journald service. This allows you to search and manage all system logs. It collects and stores logging data by maintaining structured indexed journals based on logging information received from the kernel, user processes, standard input, and system service errors. The journal records nearly every type of event generated on the system, including kernel messages, initrd (initial RAM disk) messages, service startup/shutdown, application events, and authentication and session data. Journal allows centralization and unification of logs from all sources, and it records events in structured manner which in turn helps identifying errors and in crash recovery. + journalctl is the command-line tool to view and analyze the logs from the systemd-journald service. + + +
+ <command>journalctl</command>: configuration and structure + - The systemd-journald service is enabled by default. + This section describes the journalctl location, configuring the location for persistent logs, and the journalctl entry structure. - The journal records nearly every type of event generated on the system, including Kernel messages, Initrd (initial RAM disk) messages, Service startup/shutdown, Application events, and Authentication and session data. Journal allows centralization and unification of logs from all sources, and it records events in structured manner which in turn helps identifying errors and in crash recovery. - The journald command collects log data from several sources simultaneously logs are then managed in a structured, binary format within files in /run/log/journal/ by default. Because the /run/ directory is volatile by nature, log data is lost at reboot. To make the log data persistent, create the directory /var/log/journal/ and make sure it has the correct access modes and ownership, so the systemd-journald service can store its data. To switch to persistent logging, execute the following commands: + +Verify the logs location: +&prompt.sudo; ls /var/log/journal +&prompt.sudo; ls /run/log/journal + + The journald command collects log data from several sources simultaneously logs and are then managed in a structured, binary format within files in /run/log/journal/ by default. Because the /run/ directory is volatile by nature, log data is lost at reboot. To make the log data persistent, create a directory /var/log/journal/ so the systemd-journald service can store its data. To switch to persistent logging across reboots, create /var/log/journal: &prompt.sudo; mkdir /var/log/journal &prompt.sudo; systemd-tmpfiles --create --prefix=/var/log/journal &prompt.sudo; journalctl --flush All log data stored in /run/log/journal/ are flushed into /var/log/journal/. -
- Journal entry structure - Log entry in the journal is a data structure containing the log message and numerous metadata fields, such as time stamp, source fields, systemd fields, kernel fields, and priority level. + +View the journal entry structure: +&prompt.sudo; journalctl -n 1 -o verbose +Log entry in the journal is a data structure containing the log message and metadata fields: Timestamp: The exact time the event occurred. Source Fields @@ -57,85 +66,17 @@ Priority level: A numeric value indicating the severity of the message (0=emerg, 7=debug). + +
-
- <command>journalctl</command> usage - - - Running the journalctl without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. - -Listed below are the common useful options to enhance the default journalctl behavior. All switches are described in the journalctl man page, man 1 journalctl. - - Messages related to a specific executable - - To show all journal messages related to a specific executable, specify the - full path to the executable: - -&prompt.sudo;journalctl /usr/lib/systemd/systemd - - - - - -f - - - Shows only the most recent journal messages, and prints new log entries - as they are added to the journal. - - - - - - - - Prints the messages and jumps to the end of the journal, so that the - latest entries are visible within the pager. - - - - - -r - - - Prints the messages of the journal in reverse order, so that the latest - entries are listed first. - - - - - -k - - - Shows only kernel messages. This is equivalent to the field match - _TRANSPORT=kernel (see - ). - - - - - -u - - - Shows only messages for the specified &systemd; unit. This is equivalent - to the field match - _SYSTEMD_UNIT=UNIT (see - ). - -&prompt.sudo;journalctl -u apache2 - - - - -
-
+
Filtering the journal output - When called without switches, journalctl shows the full + This section describes how to refine the search in logs according to boot numbers, for specific time interval or to view specific data fields. content of the journal, the oldest entries listed first. The output can be filtered by specific switches and fields. -
Filtering based on a boot number diff --git a/references/journalctl-usage.xml b/references/journalctl-usage.xml new file mode 100644 index 000000000..548534a3a --- /dev/null +++ b/references/journalctl-usage.xml @@ -0,0 +1,100 @@ + + + %entities; +]> + + + + + + + + + <command>journalctl</command> usage + + + Running the journalctl without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. + + + + + + + You can run the journalctl: + +
+ Using <command>journalctl</command>sage + + Running the journalctl without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. + +Listed below are the common useful options to enhance the default journalctl behavior. All switches are described in the journalctl man page, man 1 journalctl. + + Messages related to a specific executable + + To show all journal messages related to a specific executable, specify the + full path to the executable: + +&prompt.sudo;journalctl /usr/lib/systemd/systemd + + + + -f + + + Shows only the most recent journal messages, and prints new log entries + as they are added to the journal. + + + + + + + + Prints the messages and jumps to the end of the journal, so that the + latest entries are visible within the pager. + + + + + -r + + + Prints the messages of the journal in reverse order, so that the latest + entries are listed first. + + + + + -k + + + Shows only kernel messages. This is equivalent to the field match + _TRANSPORT=kernel (see + ). + + + + + -u + + + Shows only messages for the specified &systemd; unit. This is equivalent + to the field match + _SYSTEMD_UNIT=UNIT (see + ). + +&prompt.sudo;journalctl -u apache2 + + + + +
+ diff --git a/tasks/journald-configure.xml b/tasks/journald-configure.xml index f79f54626..e173259f4 100644 --- a/tasks/journald-configure.xml +++ b/tasks/journald-configure.xml @@ -16,57 +16,90 @@ xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:trans="http://docbook.org/ns/transclusion"> - Configuring journald - The topic covers the basic configuration of journald. You can configure the basic behavior of systemd-journald service by modifying /etc/systemd/journald.conf. After making the changes, you must restart systemd-journald. For more information on file description, see man 5 journald.conf.. - + You can configure the basic behavior of systemd-journald service by modifying /etc/systemd/journald.conf. - To configure journald, proceed as follows: + To configure systemd-journald, proceed as follows: + Configuring <command>systemd-journald</command> + Open the systemd-journald configuration file: +&prompt.sudo; vi /etc/systemd/journald.conf +[Journal] + +# Store journals on disk so logs survive reboot +Storage=persistent + +# Disk space limits +SystemMaxUse=2G +SystemKeepFree=10% + +# Per-file max size +SystemMaxFileSize=200M + +# RAM (runtime) journal limits +RuntimeMaxUse=500M +RuntimeKeepFree=10% + +# Log retention +MaxRetentionSec=4weeks + +# Compression for old logs +Compress=yes + +# Optional: also forward to rsyslog/syslog +ForwardToSyslog=yes + + + Modify the configurations: + + - To modify the storage type, modify Storage=auto. + To modify the storage type, modify Storage=auto. The available options are: volatile: RAM only (clears on reboot). - persistent: stored in /var/log/journal. - auto: persistent if directory exists, otherwise volatile. - none: no logs written to disk or memory. - - If the journal log data is saved to a persistent location, it uses up to 10% of the file system the /var/log/journal resides on. For example, if /var/log/journal is located on a 30 GB /var partition, the journal may use up to 3 GB of the disk space. To change this limit, change (and uncomment) the SystemMaxUse option: - - SystemMaxUse=50M -systemctl restart systemd-journald - - - - - To limit logs rate to prevent flooding logs: - + persistent: stored in /var/log/journal. + auto: persistent if directory exists, otherwise volatile. + none: no logs written to disk or memory. + + If the journal log data is saved to a persistent location, it uses up to 10% of the file system the /var/log/journal resides on. For example, if /var/log/journal is located on a 30 GB /var partition, the journal may use up to 3 GB of the disk space. To change this limit, change (and uncomment) the SystemMaxUse option: + SystemMaxUse=50M +&prompt.sudo; systemctl restart systemd-journald + + + To limit logs rate to prevent flooding logs: RateLimitIntervalSec=30s RateLimitBurst=1000 - - + + To send the journal to a terminal device to inform you about system messages on a preferred terminal screen, for example /dev/tty12: ForwardToConsole=yes TTYPath=/dev/tty12 - - + + To forward logs to syslog, modify ForwardToSyslog=yes.Journald is backward compatible with traditional syslog implementations such as rsyslog. - - Install rsyslogrpm -q rsyslog - Enable rsyslogsystemctl is-enabled rsyslog - Enable forwarding to rsyslog in in /etc/systemd/journald.confForwardToSyslog=yes - - + + Install rsyslogrpm -q rsyslog + Enable rsyslogsystemctl is-enabled rsyslog + Enable forwarding to rsyslog in in /etc/systemd/journald.confForwardToSyslog=yes + + For more information on file description, see man 5 journald.conf. + + + + Save and restart systemd-journald. + &prompt.sudo; systemctl restart systemd-journald + diff --git a/tasks/journald-filter-journals.xml b/tasks/journald-filter-journals.xml new file mode 100644 index 000000000..1e74a32fb --- /dev/null +++ b/tasks/journald-filter-journals.xml @@ -0,0 +1,37 @@ + + + %entities; +]> + + + + + + + Filter the journal output + + + + + This section describes how to refine the search in logs according to boot numbers, for specific time interval or to view specific data fields. + content of the journal, the oldest entries listed first. The output can be + filtered by specific switches and fields. + + + + You can filter journals based on boot number, time interval, and fields. + + + Filtering journals + + + From 485543cda3af15eea84f92c158aa1a7d528cf247 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Fri, 28 Nov 2025 22:18:44 +0530 Subject: [PATCH 22/32] Fixed feedback. --- articles/journalctl.asm.xml | 4 +- concepts/journal-about-journald.xml | 117 +--------------------------- references/journalctl-usage.xml | 10 +-- tasks/journald-filter-journals.xml | 63 +++++++++++++-- 4 files changed, 65 insertions(+), 129 deletions(-) diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml index 1961184ea..546964dfd 100644 --- a/articles/journalctl.asm.xml +++ b/articles/journalctl.asm.xml @@ -20,6 +20,7 @@ xmlns="http://docbook.org/ns/docbook"> + @@ -137,8 +138,9 @@ You must have &sudo; privileges. - + + diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index ff2c7397f..657c67ef7 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -25,9 +25,7 @@ journalctl is the command-line tool to view and analyze the logs from the systemd-journald service. -
- <command>journalctl</command>: configuration and structure - +
Understanding <command>journalctl</command> configuration and structure This section describes the journalctl location, configuring the location for persistent logs, and the journalctl entry structure. @@ -69,117 +67,4 @@
-
- Filtering the journal output - - - This section describes how to refine the search in logs according to boot numbers, for specific time interval or to view specific data fields. - content of the journal, the oldest entries listed first. The output can be - filtered by specific switches and fields. - -
- Filtering based on a boot number - - journalctl can filter messages based on a specific - system boot. To list all available boots, run - -&prompt.sudo;journalctl --list-boots - - The first column lists the boot offset: 0 for the - current boot, -1 for the previous one, - -2 for the one before that, etc. The second column - contains the boot ID followed by the limiting time stamps of the specific - boot. - - - Show all messages from the current boot: - -&prompt.sudo;journalctl -b - - If you need to see journal messages from the previous boot, add an offset - parameter. The following example outputs the previous boot messages: - -&prompt.sudo;journalctl -b -1 - - Another way is to list boot messages based on the boot ID. For this - purpose, use the _BOOT_ID field: - -&prompt.sudo;journalctl _BOOT_ID=156019a44a774a0bb0148a92df4af81b -
- -
- Filtering based on time interval - - You can filter the output of journalctl by specifying the - starting and/or ending date. The date specification should be of the format - 2025-06-30 9:17:16. If the time part is omitted, midnight - is assumed. If seconds are omitted, :00 is assumed. If - the date part is omitted, the current day is assumed. Instead of numeric - expression, you can specify the keywords yesterday, - today or tomorrow. They refer to - midnight of the day before the current day, of the current day, or of the - day after the current day. If you specify now, it refers - to the current time. You can also specify relative times prefixed with - - or +, referring to times before or - after the current time. - - - Show only new messages since now, and update the output continuously: - -&prompt.sudo;journalctl --since "now" -f - - Show all messages since last midnight till 3:20am: - -&prompt.sudo;journalctl --since "today" --until "3:20" -
-
- Filtering based on fields - - You can filter the output of the journal by specific fields. The syntax of - a field to be matched is FIELD_NAME=MATCHED_VALUE, such - as _SYSTEMD_UNIT=httpd.service. You can specify multiple - matches in a single query to filter the output messages even more. See - man 7 systemd.journal-fields for a list of default - fields. - - - Show messages produced by a specific process ID: - -&prompt.sudo;journalctl _PID=1039 - - Show messages belonging to a specific user ID: - -# journalctl _UID=1000 - - Show messages from the kernel ring buffer (the same as - dmesg displays): - -&prompt.sudo;journalctl _TRANSPORT=kernel - - Show messages from the service's standard or error output: - -&prompt.sudo;journalctl _TRANSPORT=stdout - - Show messages produced by a specified service only: - -&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service - - If two different fields are specified, only entries that match both - expressions at the same time are shown: - -&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=1488 - - If two matches refer to the same field, all entries matching either - expression are shown: - -&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service - - You can use the + separator to combine two expressions in - a logical OR. The following example shows all messages - from the Avahi service process with the process ID 1480 together with all - messages from the D-Bus service: - -&prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=1480 + _SYSTEMD_UNIT=dbus.service -
-
diff --git a/references/journalctl-usage.xml b/references/journalctl-usage.xml index 548534a3a..a4997344f 100644 --- a/references/journalctl-usage.xml +++ b/references/journalctl-usage.xml @@ -18,7 +18,7 @@ xmlns:trans="http://docbook.org/ns/transclusion"> - <command>journalctl</command> usage + Using <command>journalctl</command> Running the journalctl without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. @@ -31,7 +31,7 @@ You can run the journalctl:
- Using <command>journalctl</command>sage + Use <command>journalctl</command> Running the journalctl without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. @@ -77,8 +77,7 @@ Shows only kernel messages. This is equivalent to the field match - _TRANSPORT=kernel (see - ). + _TRANSPORT=kernel. @@ -88,8 +87,7 @@ Shows only messages for the specified &systemd; unit. This is equivalent to the field match - _SYSTEMD_UNIT=UNIT (see - ). + _SYSTEMD_UNIT=UNIT. &prompt.sudo;journalctl -u apache2 diff --git a/tasks/journald-filter-journals.xml b/tasks/journald-filter-journals.xml index 1e74a32fb..3ba4109ee 100644 --- a/tasks/journald-filter-journals.xml +++ b/tasks/journald-filter-journals.xml @@ -8,7 +8,7 @@ - - Filter the journal output @@ -30,8 +30,59 @@ in the assembly --> You can filter journals based on boot number, time interval, and fields. - - Filtering journals - - + + Filtering journals + Filter logs based on specific system boot: + + + List all the available boots: + &prompt.sudo;journalctl --list-boots + The first column lists the boot offset: 0 for the current boot, -1 for the previous one, + -2 for the one before that, etc. The second column contains the boot ID followed by the limiting time stamps of the specific + boot. + + Show all messages from the current boot: + &prompt.sudo;journalctl -b + To view journal messages from the previous boot, add an offset + parameter. The following example command shows the previous boot messages: + &prompt.sudo;journalctl -b -1 + To view boot messages based on the boot ID, 156019a44a774a0bb0148a92df4af81b: + &prompt.sudo;journalctl _BOOT_ID=156019a44a774a0bb0148a92df4af81b + + Filter logs based on time interval + You can filter the output of journalctl by specifying the starting and/or ending date. The date specification should be of the formatYYYY-MM-DD H:MM:SS. If the time part is omitted, midnight is assumed. If seconds are omitted, :00 is assumed. If the date part is omitted, the current day is assumed. Instead of numeric expression, you can specify the keywords yesterday, + today or tomorrow. They refer to midnight of the day before the current day, of the current day, or of the day after the current day. If you specify now, it refers to the current time. You can also specify relative times prefixed with - or +, referring to times before or after the current time. + + + To view only new messages since now, and update the output continuously: + &prompt.sudo;journalctl --since "now" -f + To view all messages since last midnight till 3:20am: + &prompt.sudo;journalctl --since "today" --until "3:20" + + + Filter logs based on fields + You can filter the output of the journal by specific fields. The syntax of a field to be matched is FIELD_NAME=MATCHED_VALUE, such + as _SYSTEMD_UNIT=httpd.service. You can specify multiple matches in a single query to filter the output messages even more. See + man 7 systemd.journal-fields for a list of default fields. + + + To view messages produced by a specific process ID, for example PID_1039: +&prompt.sudo;journalctl _PID=1039 + To view messages belonging to a specific user ID, for example UID_1000: + # journalctl _UID=1000 + To view messages from the kernel ring buffer (the same as dmesg displays): + &prompt.sudo;journalctl _TRANSPORT=kernel + To view messages from the service's standard or error output: + &prompt.sudo;journalctl _TRANSPORT=stdout + To view messages produced by a specified service only: + &prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service + If two different fields are specified, only entries that match both expressions at the same time are shown: + &prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=1488 + If two matches refer to the same field, all entries matching either expression are shown: + &prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service + You can use the + separator to combine two expressions in a logical OR. The following example shows all messages from the Avahi service process with the process ID 1480 together with all messages from the D-Bus service: + &prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=1480 + _SYSTEMD_UNIT=dbus.service + + + From 65cdc6e6c8cc3ce9c682586ba52ed3d791cd1211 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Fri, 28 Nov 2025 22:44:05 +0530 Subject: [PATCH 23/32] Fixed validation errors. --- articles/journalctl.asm.xml | 7 ------- references/journalctl-usage.xml | 4 ++-- 2 files changed, 2 insertions(+), 9 deletions(-) diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml index 2248ad2c9..546964dfd 100644 --- a/articles/journalctl.asm.xml +++ b/articles/journalctl.asm.xml @@ -37,11 +37,9 @@ xmlns="http://docbook.org/ns/docbook"> Mastering System Logs: From <command>systemd-journald</command> to <command>journalctl</command> -Mastering System Logs: From <command>systemd-journald</command> to <command>journalctl</command> 2025-11-26 -2025-11-26 Initial version @@ -66,12 +64,10 @@ Initial version Mastering System Logs: From systemd-journald to journalctl -Mastering System Logs: From systemd-journald to journalctl How to view and manage &productnameshort; logs using journalctl Mastering System Logs: From systemd-journald to journalctl -Mastering System Logs: From systemd-journald to journalctl Configuration @@ -111,7 +107,6 @@ You can view and analyze logs from systemd-journald using the This article is intended to provide a complete overview of tasks that can be performed using the journalctl command-line tool. -This article is intended to provide a complete overview of tasks that can be performed using the journalctl command-line tool. @@ -136,7 +131,6 @@ You will be able to view your system logs using journalctl. You must have &sudo; privileges. -You must have &sudo; privileges. @@ -147,7 +141,6 @@ You must have &sudo; privileges. - diff --git a/references/journalctl-usage.xml b/references/journalctl-usage.xml index a4997344f..57f1869af 100644 --- a/references/journalctl-usage.xml +++ b/references/journalctl-usage.xml @@ -9,7 +9,7 @@ - You can run the journalctl: -
+
Use <command>journalctl</command> Running the journalctl without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. From b74a66e0d961a811f8e7a9743ba67a60caa2ce92 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Tue, 2 Dec 2025 12:55:43 +0530 Subject: [PATCH 24/32] Fixed comments from JanaH. --- tasks/systemd-journald-troubleshooting.xml | 25 +++++++++++++--------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/tasks/systemd-journald-troubleshooting.xml b/tasks/systemd-journald-troubleshooting.xml index ff0b47542..66d1b8327 100644 --- a/tasks/systemd-journald-troubleshooting.xml +++ b/tasks/systemd-journald-troubleshooting.xml @@ -27,14 +27,19 @@ in the assembly --> - Troubleshoot <command>journalctl</command> errors - Identify the severity and content of the error.The errors are marked with priority level: + View &systemd; errors + View the list of failed &systemd; units: + systemctl --failed +The list of all failed services appear. + Identify the severity and content of the error. + journalctl -p 0..7 -b + The list of errors with priority level 0 to 7 appears. The errors are marked with priority level: 0-2: emerg, alert, crit: Critical issues, system collapse imminent. 3: err (Error): A service or application failed to complete a requested operation. 4: warning : Something undesirable happened but is not an immediate failure. 5-7: notice, info, debug: Normal operational information and developer diagnostics. -Identify the failing unit using the following command: +View the error log for the failing service using the following command: journalctl -u <failing_service_name> The lines preceding the termination message includes information on the error. Exit Status: f a service stops, look for a message like Process xxx exited with status 1/FAILURE. A status of 0 is success. Any non-zero status indicates an error. @@ -43,26 +48,26 @@ in the assembly --> Use detailed views of logs to get detailed information on the error. journalctl -xe -To view all messages from the Apache service during the current boot, with detailed explanations, run the following command: +For example, to view all messages from the Apache service during the current boot, with detailed explanations, run the following command: journalctl -u httpd.service -b -xe
- Troubleshoot apache2 error + Troubleshoot &systemd; error - This section introduces a simple example to illustrate how to find and fix + This section introduces an example to illustrate how to find and fix the error reported by &systemd; during apache2 start-up. - Try to start the apache2 service: + Start the apache2 service: -# systemctl start apache2 +systemctl start apache2 Job for apache2.service failed. See 'systemctl status apache2' and 'journalctl -xn' for details. - Let us see what the service's status says: + View the service status: &prompt.sudo;systemctl status apache2 apache2.service - The Apache Webserver @@ -76,7 +81,7 @@ apache2.service - The Apache Webserver - Show the verbose version of messages related to process ID 11026: + View the verbose version of messages related to process ID 11026: &prompt.sudo;journalctl -o verbose _PID=11026 [...] From cfcb6acdef62ea0f8188edcc6e102fa1c8228beb Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Tue, 2 Dec 2025 13:04:28 +0530 Subject: [PATCH 25/32] Fixed comments from JanaH. --- tasks/systemd-journald-troubleshooting.xml | 47 +++++++++------------- 1 file changed, 19 insertions(+), 28 deletions(-) diff --git a/tasks/systemd-journald-troubleshooting.xml b/tasks/systemd-journald-troubleshooting.xml index 66d1b8327..2610df1a9 100644 --- a/tasks/systemd-journald-troubleshooting.xml +++ b/tasks/systemd-journald-troubleshooting.xml @@ -30,22 +30,27 @@ in the assembly --> View &systemd; errors View the list of failed &systemd; units: systemctl --failed -The list of all failed services appear. +The list of all failed services appear. Identify the severity and content of the error. journalctl -p 0..7 -b - The list of errors with priority level 0 to 7 appears. The errors are marked with priority level: -0-2: emerg, alert, crit: Critical issues, system collapse imminent. + The list of errors with priority level 0 to 7 appears. The errors are marked with priority level: + + + 0-2: emerg, alert, crit: Critical issues, system collapse imminent. 3: err (Error): A service or application failed to complete a requested operation. - 4: warning : Something undesirable happened but is not an immediate failure. - 5-7: notice, info, debug: Normal operational information and developer diagnostics. + 4: warning : Something undesirable happened but is not an immediate failure. + 5-7: notice, info, debug: Normal operational information and developer diagnostics. + View the error log for the failing service using the following command: journalctl -u <failing_service_name> The lines preceding the termination message includes information on the error. -Exit Status: f a service stops, look for a message like Process xxx exited with status 1/FAILURE. A status of 0 is success. Any non-zero status indicates an error. + + Exit Status: f a service stops, look for a message like Process xxx exited with status 1/FAILURE. A status of 0 is success. Any non-zero status indicates an error. Configuration Errors: Messages containing phrases like No such file or directory, Permission denied, or Address already in use usually point to a problem in the service's configuration file - Out-of-Memory (OOM): Out-of-Memory (OOM) - + Out-of-Memory (OOM): Out-of-Memory (OOM) + + Use detailed views of logs to get detailed information on the error. journalctl -xe For example, to view all messages from the Apache service during the current boot, with detailed explanations, run the following command: @@ -56,33 +61,23 @@ in the assembly --> This section introduces an example to illustrate how to find and fix - the error reported by &systemd; during apache2 start-up. - + the error reported by &systemd; during apache2 start-up. - - Start the apache2 service: - + Start the apache2 service: systemctl start apache2 Job for apache2.service failed. See 'systemctl status apache2' and 'journalctl -xn' for details. - - - View the service status: - + View the service status: &prompt.sudo;systemctl status apache2 apache2.service - The Apache Webserver Loaded: loaded (/usr/lib/systemd/system/apache2.service; disabled) Active: failed (Result: exit-code) since Tue 2025-09-03 11:08:13 EDT; 7min ago Process: 11026 ExecStop=/usr/sbin/start_apache2 -D SYSTEMD -DFOREGROUND \ -k graceful-stop (code=exited, status=1/FAILURE) - - The ID of the process causing the failure is 11026. - + The ID of the process causing the failure is 11026. - - View the verbose version of messages related to process ID 11026: - + View the verbose version of messages related to process ID 11026: &prompt.sudo;journalctl -o verbose _PID=11026 [...] MESSAGE=AH00526: Syntax error on line 6 of /etc/apache2/default-server.conf: @@ -90,11 +85,7 @@ MESSAGE=AH00526: Syntax error on line 6 of /etc/apache2/default-server.conf: MESSAGE=Invalid command 'DocumenttRoot', perhaps misspelled or defined by a module [...] - - - Fix the typo inside /etc/apache2/default-server.conf, - start the apache2 service, and print its status: - + Fix the typo inside /etc/apache2/default-server.conf, start the apache2 service, and print its status: &prompt.sudo;systemctl start apache2 && systemctl status apache2 apache2.service - The Apache Webserver Loaded: loaded (/usr/lib/systemd/system/apache2.service; disabled) From 2c061b591c5050c5cd69b4eeae8e9790c223a3da Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Tue, 2 Dec 2025 13:10:37 +0530 Subject: [PATCH 26/32] Fixed comments from JanaH. --- tasks/systemd-journald-troubleshooting.xml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tasks/systemd-journald-troubleshooting.xml b/tasks/systemd-journald-troubleshooting.xml index 2610df1a9..ef6d25296 100644 --- a/tasks/systemd-journald-troubleshooting.xml +++ b/tasks/systemd-journald-troubleshooting.xml @@ -26,8 +26,8 @@ in the assembly --> +
View &systemd; errors - View &systemd; errors View the list of failed &systemd; units: systemctl --failed The list of all failed services appear. @@ -56,6 +56,7 @@ in the assembly --> For example, to view all messages from the Apache service during the current boot, with detailed explanations, run the following command: journalctl -u httpd.service -b -xe +
Troubleshoot &systemd; error From 7fceb5bfdc7ca2b157829258ca34210ddde66be0 Mon Sep 17 00:00:00 2001 From: Shalaka Harne Date: Tue, 2 Dec 2025 12:55:43 +0530 Subject: [PATCH 27/32] Fixed comments from JanaH. --- tasks/systemd-journald-troubleshooting.xml | 63 +++++++++++----------- 1 file changed, 30 insertions(+), 33 deletions(-) diff --git a/tasks/systemd-journald-troubleshooting.xml b/tasks/systemd-journald-troubleshooting.xml index ff0b47542..ef6d25296 100644 --- a/tasks/systemd-journald-troubleshooting.xml +++ b/tasks/systemd-journald-troubleshooting.xml @@ -26,58 +26,59 @@ in the assembly --> +
View &systemd; errors - Troubleshoot <command>journalctl</command> errors - Identify the severity and content of the error.The errors are marked with priority level: -0-2: emerg, alert, crit: Critical issues, system collapse imminent. + View the list of failed &systemd; units: + systemctl --failed +The list of all failed services appear. + Identify the severity and content of the error. + journalctl -p 0..7 -b + The list of errors with priority level 0 to 7 appears. The errors are marked with priority level: + + + 0-2: emerg, alert, crit: Critical issues, system collapse imminent. 3: err (Error): A service or application failed to complete a requested operation. - 4: warning : Something undesirable happened but is not an immediate failure. - 5-7: notice, info, debug: Normal operational information and developer diagnostics. + 4: warning : Something undesirable happened but is not an immediate failure. + 5-7: notice, info, debug: Normal operational information and developer diagnostics. + -Identify the failing unit using the following command: +View the error log for the failing service using the following command: journalctl -u <failing_service_name> The lines preceding the termination message includes information on the error. -Exit Status: f a service stops, look for a message like Process xxx exited with status 1/FAILURE. A status of 0 is success. Any non-zero status indicates an error. + + Exit Status: f a service stops, look for a message like Process xxx exited with status 1/FAILURE. A status of 0 is success. Any non-zero status indicates an error. Configuration Errors: Messages containing phrases like No such file or directory, Permission denied, or Address already in use usually point to a problem in the service's configuration file - Out-of-Memory (OOM): Out-of-Memory (OOM) - + Out-of-Memory (OOM): Out-of-Memory (OOM) + + Use detailed views of logs to get detailed information on the error. journalctl -xe -To view all messages from the Apache service during the current boot, with detailed explanations, run the following command: +For example, to view all messages from the Apache service during the current boot, with detailed explanations, run the following command: journalctl -u httpd.service -b -xe +
- Troubleshoot apache2 error + Troubleshoot &systemd; error - This section introduces a simple example to illustrate how to find and fix - the error reported by &systemd; during apache2 start-up. - + This section introduces an example to illustrate how to find and fix + the error reported by &systemd; during apache2 start-up. - - Try to start the apache2 service: - -# systemctl start apache2 + Start the apache2 service: +systemctl start apache2 Job for apache2.service failed. See 'systemctl status apache2' and 'journalctl -xn' for details. - - - Let us see what the service's status says: - + View the service status: &prompt.sudo;systemctl status apache2 apache2.service - The Apache Webserver Loaded: loaded (/usr/lib/systemd/system/apache2.service; disabled) Active: failed (Result: exit-code) since Tue 2025-09-03 11:08:13 EDT; 7min ago Process: 11026 ExecStop=/usr/sbin/start_apache2 -D SYSTEMD -DFOREGROUND \ -k graceful-stop (code=exited, status=1/FAILURE) - - The ID of the process causing the failure is 11026. - + The ID of the process causing the failure is 11026. - - Show the verbose version of messages related to process ID 11026: - + View the verbose version of messages related to process ID 11026: &prompt.sudo;journalctl -o verbose _PID=11026 [...] MESSAGE=AH00526: Syntax error on line 6 of /etc/apache2/default-server.conf: @@ -85,11 +86,7 @@ MESSAGE=AH00526: Syntax error on line 6 of /etc/apache2/default-server.conf: MESSAGE=Invalid command 'DocumenttRoot', perhaps misspelled or defined by a module [...] - - - Fix the typo inside /etc/apache2/default-server.conf, - start the apache2 service, and print its status: - + Fix the typo inside /etc/apache2/default-server.conf, start the apache2 service, and print its status: &prompt.sudo;systemctl start apache2 && systemctl status apache2 apache2.service - The Apache Webserver Loaded: loaded (/usr/lib/systemd/system/apache2.service; disabled) From 3d679d1c2b049f495257e3d448c1d8fc0c4fc553 Mon Sep 17 00:00:00 2001 From: Jana Halackova Date: Thu, 4 Dec 2025 16:57:04 +0100 Subject: [PATCH 28/32] Added first batch of changes. --- articles/journalctl.asm.xml | 6 ++-- concepts/journal-about-journald.xml | 15 ++++++++-- concepts/journal-structure.xml | 45 +++++++++++++++++++++++++++++ 3 files changed, 62 insertions(+), 4 deletions(-) create mode 100644 concepts/journal-structure.xml diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml index 546964dfd..632bc2872 100644 --- a/articles/journalctl.asm.xml +++ b/articles/journalctl.asm.xml @@ -137,10 +137,12 @@ You must have &sudo; privileges. - + + + - + diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index 657c67ef7..4b9549cf4 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -16,11 +16,22 @@ xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:trans="http://docbook.org/ns/transclusion"> - About journald + About <literal>journald</literal> - systemd uses journald as its logging system. The systemd-journald service is enabled by default. + journald is a &systemd; service responsible for collecting, indexing, and storing log data. The collected events include kernel messages, initrd (initial RAM disk) messages, + service startup/shutdown, application events, and authentication and session data. + + + + + On &productname; the systemd-journald service is enabled and started by + default. The service logs the data into the journal described in + + + + as its logging system. The systemd-journald service is enabled by default. All system events are written to the journal, a system service managed by systemd-journald service. This allows you to search and manage all system logs. It collects and stores logging data by maintaining structured indexed journals based on logging information received from the kernel, user processes, standard input, and system service errors. The journal records nearly every type of event generated on the system, including kernel messages, initrd (initial RAM disk) messages, service startup/shutdown, application events, and authentication and session data. Journal allows centralization and unification of logs from all sources, and it records events in structured manner which in turn helps identifying errors and in crash recovery. journalctl is the command-line tool to view and analyze the logs from the systemd-journald service. diff --git a/concepts/journal-structure.xml b/concepts/journal-structure.xml new file mode 100644 index 000000000..5f26e3d17 --- /dev/null +++ b/concepts/journal-structure.xml @@ -0,0 +1,45 @@ + + + + + %entities; +]> + + + + + + + About journal + + + + + Journal is a centralization and unification of logs from all sources, and it stores events in structured manner which in turn helps identifying errors and in crash recovery. + + + +
+ Where can I find the journal? + + By default, journald stores the collected data in the volatile memory in + /run/log/journal, so after reboot the data is lost. + +
+
+ The structure of the journal + + A paragraph of text, answering the question above and explaining the + mechanism behind foo bar. + + +
+ From fbb2bac184b7ef7ec03f9f407d6e1ad0bb966d6c Mon Sep 17 00:00:00 2001 From: Jana Halackova Date: Fri, 5 Dec 2025 16:26:16 +0100 Subject: [PATCH 29/32] Changed the journal section. --- concepts/journal-about-journald.xml | 55 +------------- concepts/journal-structure.xml | 114 +++++++++++++++++++++++++++- 2 files changed, 114 insertions(+), 55 deletions(-) diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index 4b9549cf4..7542a0c36 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -27,55 +27,8 @@ On &productname; the systemd-journald service is enabled and started by - default. The service logs the data into the journal described in - - - - as its logging system. The systemd-journald service is enabled by default. - All system events are written to the journal, a system service managed by systemd-journald service. This allows you to search and manage all system logs. It collects and stores logging data by maintaining structured indexed journals based on logging information received from the kernel, user processes, standard input, and system service errors. The journal records nearly every type of event generated on the system, including kernel messages, initrd (initial RAM disk) messages, service startup/shutdown, application events, and authentication and session data. Journal allows centralization and unification of logs from all sources, and it records events in structured manner which in turn helps identifying errors and in crash recovery. - journalctl is the command-line tool to view and analyze the logs from the systemd-journald service. - - -
Understanding <command>journalctl</command> configuration and structure - - This section describes the journalctl location, configuring the location for persistent logs, and the journalctl entry structure. - - -Verify the logs location: -&prompt.sudo; ls /var/log/journal -&prompt.sudo; ls /run/log/journal - - The journald command collects log data from several sources simultaneously logs and are then managed in a structured, binary format within files in /run/log/journal/ by default. Because the /run/ directory is volatile by nature, log data is lost at reboot. To make the log data persistent, create a directory /var/log/journal/ so the systemd-journald service can store its data. To switch to persistent logging across reboots, create /var/log/journal: - &prompt.sudo; mkdir /var/log/journal -&prompt.sudo; systemd-tmpfiles --create --prefix=/var/log/journal -&prompt.sudo; journalctl --flush -All log data stored in /run/log/journal/ are flushed into /var/log/journal/. - -View the journal entry structure: -&prompt.sudo; journalctl -n 1 -o verbose -Log entry in the journal is a data structure containing the log message and metadata fields: -Timestamp: The exact time the event occurred. -Source Fields - - _PID: Process ID of the sender. - _UID/_GID: User/Group ID of the sender. - _EXE: Path to the executable. - _COMM: Name of the executable. - - -System Fields - - _SYSTEMD_UNIT: The systemd unit (service) that generated the log (e.g., sshd.service). - _BOOT_ID: A unique identifier for the specific system boot session. - - -Kernel Fields - - _TRANSPORT: How the message was logged (e.g., kernel, syslog, stdout). - -Priority level: A numeric value indicating the severity of the message (0=emerg, 7=debug). - - - -
+ default. The service logs the data into the journal described in . + + + diff --git a/concepts/journal-structure.xml b/concepts/journal-structure.xml index 5f26e3d17..742670914 100644 --- a/concepts/journal-structure.xml +++ b/concepts/journal-structure.xml @@ -23,7 +23,7 @@ - Journal is a centralization and unification of logs from all sources, and it stores events in structured manner which in turn helps identifying errors and in crash recovery. + Journal is a centralization and unification of logs from all sources, and it stores events in structured manner which in turn helps identifying errors and in crash recovery. @@ -33,13 +33,119 @@ By default, journald stores the collected data in the volatile memory in /run/log/journal, so after reboot the data is lost. + + If systemd-journald is configured to store the logs in a persistent + manner, you can find the journal in /var/log/journal. Ensure that the + directoy exists: + + + + + Check if the directory exist: + + &prompt.sudo;ls /var/log +... +journal +... + + + + + + If the /var/log/journal directory does not exist, create + it: + &prompt.sudo;mkdir /var/log/journal + + + + + Set correct ownership and access perimissions: + + &prompt.sudo; systemd-tmpfiles --create --prefix=/var/log/journal + + + + To flush the data from RAM to the directory: + + &prompt.sudo; journalctl --flush + + + For details about + the service configuration, refer to . +
- The structure of the journal + The journal logs structure - A paragraph of text, answering the question above and explaining the - mechanism behind foo bar. + The logs are stored in binary format across several files. To view the structure of a log + entry, proceed as follows: + &prompt.sudo; journalctl -n 1 -o verbose + Fri 2025-12-05 10:52:53.284321 CET [s=5b7ae2e926794210bf832d014f5f560a;i=d49752> + _UID=1000 + _AUDIT_SESSION=3 + _AUDIT_LOGINUID=1000 + _SYSTEMD_OWNER_UID=1000 + _SYSTEMD_UNIT=user@1000.service + _SYSTEMD_SLICE=user-1000.slice + _MACHINE_ID=d3489468c8534c5d81a2860cf9a2a20e + _RUNTIME_SCOPE=system + _SELINUX_CONTEXT=unconfined + PRIORITY=6 + _TRANSPORT=syslog + _BOOT_ID=d095069bd59b4bc4bf67c8c71999243b + SYSLOG_IDENTIFIER=sudo + SYSLOG_TIMESTAMP=Dec 5 10:52:53 + _PID=25806 + _COMM=sudo + _EXE=/usr/bin/sudo + _CMDLINE=sudo journalctl -n 1 -o verbose + + ... + + The log entry is a data structure containing the log message and metadata fields: + + + Timestamp + + +The exact time the event occured + + + + + Source Fields + + + + _PID: process ID of the sender + _UID/_GID: User/Group ID of the sender + _EXE: path to the executable + _COMM: name of the executable + + + + + System Fields + + + _SYSTEMD_UNIT: The systemd unit (service) that generated the + log (for example, sshd.service) + _BOOT_ID: A unique identifier for the specific system boot session + + + + + Kernel Fields + _TRANSPORT: How the message was logged (e.g., kernel, syslog, stdout). + + + Priority level + + A numeric value indicating the severity of the message (0=emerg, 7=debug) + + +
From 5d26a1a00af24b44643380f074778dd90d742951 Mon Sep 17 00:00:00 2001 From: Jana Halackova Date: Tue, 9 Dec 2025 08:43:45 +0100 Subject: [PATCH 30/32] Completed the article. --- articles/journalctl.asm.xml | 9 +++- concepts/journactl-about.xml | 38 +++++++++++++ references/journalctl-usage.xml | 32 ++++++----- tasks/journald-configure.xml | 2 +- tasks/journald-filter-journals.xml | 87 +++++++++++++++--------------- 5 files changed, 108 insertions(+), 60 deletions(-) create mode 100644 concepts/journactl-about.xml diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml index 632bc2872..ce591afb4 100644 --- a/articles/journalctl.asm.xml +++ b/articles/journalctl.asm.xml @@ -15,7 +15,9 @@ xmlns="http://docbook.org/ns/docbook"> - + + + @@ -140,8 +142,11 @@ You must have &sudo; privileges. - + + + + diff --git a/concepts/journactl-about.xml b/concepts/journactl-about.xml new file mode 100644 index 000000000..f5d1bf822 --- /dev/null +++ b/concepts/journactl-about.xml @@ -0,0 +1,38 @@ + + + + + %entities; +]> + + + + + + + The <command>journalctl</command> command + + + + +journalctl is a command-line utility used to query and display logs collected by +the systemd-journald. + + + + + Because the logging system stores data in a binary format (for performance and security) rather + than plain text, you cannot use standard tools like cat or + less to open the files directly. So the journalctl + command decodes the data and displays it according to the provided parameters. + + + diff --git a/references/journalctl-usage.xml b/references/journalctl-usage.xml index 57f1869af..1f9ff7977 100644 --- a/references/journalctl-usage.xml +++ b/references/journalctl-usage.xml @@ -21,22 +21,20 @@ Using <command>journalctl</command> - Running the journalctl without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. - +This section describes the generic usage of the journalctl command. + + - - - You can run the journalctl: - -
- Use <command>journalctl</command> - + Running the journalctl without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. -Listed below are the common useful options to enhance the default journalctl behavior. All switches are described in the journalctl man page, man 1 journalctl. - + + The general syntax of the journalctl command is as follows: + + &prompt.sudo;journalctl [OPTIONS...] [MATCHES...] + Messages related to a specific executable To show all journal messages related to a specific executable, specify the @@ -44,6 +42,10 @@ &prompt.sudo;journalctl /usr/lib/systemd/systemd + + Running the command without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. + +Listed below are the common useful options to enhance the default journalctl behavior: -f @@ -55,7 +57,7 @@ - + Prints the messages and jumps to the end of the journal, so that the @@ -93,6 +95,8 @@ - -
+ + For a complete list of options refer to man page, man 1 journalctl. + + diff --git a/tasks/journald-configure.xml b/tasks/journald-configure.xml index e173259f4..2ef46a909 100644 --- a/tasks/journald-configure.xml +++ b/tasks/journald-configure.xml @@ -92,7 +92,7 @@ TTYPath=/dev/tty12 Install rsyslogrpm -q rsyslog Enable rsyslogsystemctl is-enabled rsyslog - Enable forwarding to rsyslog in in /etc/systemd/journald.confForwardToSyslog=yes + Enable forwarding to rsyslog in /etc/systemd/journald.confForwardToSyslog=yes For more information on file description, see man 5 journald.conf. diff --git a/tasks/journald-filter-journals.xml b/tasks/journald-filter-journals.xml index 3ba4109ee..85f6285c3 100644 --- a/tasks/journald-filter-journals.xml +++ b/tasks/journald-filter-journals.xml @@ -28,61 +28,62 @@ in the assembly --> - You can filter journals based on boot number, time interval, and fields. + You can filter journals based on boot number, time interval, and fields. For details refer to following sections. - - Filtering journals - Filter logs based on specific system boot: - - - List all the available boots: - &prompt.sudo;journalctl --list-boots - The first column lists the boot offset: 0 for the current boot, -1 for the previous one, +
+ Filter logs based on specific system boot + + To list logs for all the available boots, run the command as follows: + + &prompt.sudo;journalctl --list-boots + The first column lists the boot offset: 0 for the current boot, -1 for the previous one, -2 for the one before that, etc. The second column contains the boot ID followed by the limiting time stamps of the specific boot. - - Show all messages from the current boot: - &prompt.sudo;journalctl -b - To view journal messages from the previous boot, add an offset + + To show all messages from the current boot: + + &prompt.sudo;journalctl -b + To view journal messages from the previous boot, add an offset parameter. The following example command shows the previous boot messages: - &prompt.sudo;journalctl -b -1 - To view boot messages based on the boot ID, 156019a44a774a0bb0148a92df4af81b: - &prompt.sudo;journalctl _BOOT_ID=156019a44a774a0bb0148a92df4af81b - - Filter logs based on time interval - You can filter the output of journalctl by specifying the starting and/or ending date. The date specification should be of the formatYYYY-MM-DD H:MM:SS. If the time part is omitted, midnight is assumed. If seconds are omitted, :00 is assumed. If the date part is omitted, the current day is assumed. Instead of numeric expression, you can specify the keywords yesterday, - today or tomorrow. They refer to midnight of the day before the current day, of the current day, or of the day after the current day. If you specify now, it refers to the current time. You can also specify relative times prefixed with - or +, referring to times before or after the current time. - - + &prompt.sudo;journalctl -b -1 + To view boot messages based on the boot ID, 156019a44a774a0bb0148a92df4af81b: + &prompt.sudo;journalctl _BOOT_ID=156019a44a774a0bb0148a92df4af81b +
+
+ Filtering logs based on time interval + You can filter the output of journalctl by specifying the starting and/or ending date. The date specification should be of the formatYYYY-MM-DD H:MM:SS. If the time part is omitted, midnight is assumed. If seconds are omitted, :00 is assumed. If the date part is omitted, the current day is assumed. Instead of numeric expression, you can specify the keywords yesterday, + today or tomorrow. They refer to midnight of the day + before the current day, of the current day, or of the day after the current day. If you specify + now, it refers to the current time. You can also specify relative times + prefixed with - or +, referring to times before or after + the current time. + To view only new messages since now, and update the output continuously: - &prompt.sudo;journalctl --since "now" -f - To view all messages since last midnight till 3:20am: - &prompt.sudo;journalctl --since "today" --until "3:20" - - - Filter logs based on fields + &prompt.sudo;journalctl --since "now" -f + To view all messages since last midnight till 3:20am: + &prompt.sudo;journalctl --since "today" --until "3:20" +
+
+ Filtering logs based on fields + You can filter the output of the journal by specific fields. The syntax of a field to be matched is FIELD_NAME=MATCHED_VALUE, such as _SYSTEMD_UNIT=httpd.service. You can specify multiple matches in a single query to filter the output messages even more. See man 7 systemd.journal-fields for a list of default fields. - - - To view messages produced by a specific process ID, for example PID_1039: -&prompt.sudo;journalctl _PID=1039 - To view messages belonging to a specific user ID, for example UID_1000: - # journalctl _UID=1000 - To view messages from the kernel ring buffer (the same as dmesg displays): - &prompt.sudo;journalctl _TRANSPORT=kernel - To view messages from the service's standard or error output: - &prompt.sudo;journalctl _TRANSPORT=stdout - To view messages produced by a specified service only: + + To view messages produced by a specific process ID: PID_1039: +&prompt.sudo;journalctl _PID=1039To view messages belonging to a specific user ID: UID_1000: + &prompt.sudo; journalctl _UID=1000 + To view messages from the kernel ring buffer (the same as dmesg displays): + &prompt.sudo;journalctl _TRANSPORT=kernel + To view messages from the service's standard or error output: + &prompt.sudo;journalctl _TRANSPORT=stdout + To view messages produced by a specified service only: &prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service If two different fields are specified, only entries that match both expressions at the same time are shown: &prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=1488 If two matches refer to the same field, all entries matching either expression are shown: &prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _SYSTEMD_UNIT=dbus.service You can use the + separator to combine two expressions in a logical OR. The following example shows all messages from the Avahi service process with the process ID 1480 together with all messages from the D-Bus service: - &prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=1480 + _SYSTEMD_UNIT=dbus.service - - - + &prompt.sudo;journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=1480 + _SYSTEMD_UNIT=dbus.service +
From f234c650f07a996842944084d4d3ee61fea430ab Mon Sep 17 00:00:00 2001 From: Shalaka Harne <135588263+harneshalaka@users.noreply.github.com> Date: Thu, 11 Dec 2025 21:16:50 +0530 Subject: [PATCH 31/32] Apply suggestions from code review Fixed editorial comments. Co-authored-by: Daria Vladykina --- articles/journalctl.asm.xml | 6 +++--- concepts/journactl-about.xml | 2 +- concepts/journal-about-journald.xml | 4 ++-- concepts/journal-structure.xml | 22 +++++++++++----------- references/journalctl-usage.xml | 4 ++-- tasks/journald-configure.xml | 12 ++++++------ tasks/journald-filter-journals.xml | 14 +++++++------- tasks/systemd-journald-troubleshooting.xml | 17 +++++++++-------- 8 files changed, 41 insertions(+), 40 deletions(-) diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml index ce591afb4..5d3b993c8 100644 --- a/articles/journalctl.asm.xml +++ b/articles/journalctl.asm.xml @@ -67,7 +67,7 @@ Initial version Mastering System Logs: From systemd-journald to journalctl -How to view and manage &productnameshort; logs using journalctl +Learn how to view and manage &productnameshort; logs using journalctl Mastering System Logs: From systemd-journald to journalctl @@ -100,7 +100,7 @@ How to view and manage &productnameshort; logs using journalctlWHAT? -You can view and analyze logs from systemd-journald using the journalctl command-line tool. +View and analyze logs from systemd-journald using the journalctl command-line tool. @@ -108,7 +108,7 @@ You can view and analyze logs from systemd-journald using the WHY? -This article is intended to provide a complete overview of tasks that can be performed using the journalctl command-line tool. +This article provides a complete overview of tasks that can be performed using the journalctl command-line tool. diff --git a/concepts/journactl-about.xml b/concepts/journactl-about.xml index f5d1bf822..84ed3672a 100644 --- a/concepts/journactl-about.xml +++ b/concepts/journactl-about.xml @@ -31,7 +31,7 @@ the systemd-journald. Because the logging system stores data in a binary format (for performance and security) rather than plain text, you cannot use standard tools like cat or - less to open the files directly. So the journalctl + less to open the files directly. So, the journalctl command decodes the data and displays it according to the provided parameters. diff --git a/concepts/journal-about-journald.xml b/concepts/journal-about-journald.xml index 7542a0c36..c014e17c2 100644 --- a/concepts/journal-about-journald.xml +++ b/concepts/journal-about-journald.xml @@ -16,7 +16,7 @@ xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:trans="http://docbook.org/ns/transclusion"> - About <literal>journald</literal> + The <command>systemd-journald</command> service @@ -26,7 +26,7 @@ - On &productname; the systemd-journald service is enabled and started by + On &productname;, the systemd-journald service is enabled and started by default. The service logs the data into the journal described in . diff --git a/concepts/journal-structure.xml b/concepts/journal-structure.xml index 742670914..536f7d58d 100644 --- a/concepts/journal-structure.xml +++ b/concepts/journal-structure.xml @@ -18,12 +18,12 @@ xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:trans="http://docbook.org/ns/transclusion"> - About journal + About the journal - Journal is a centralization and unification of logs from all sources, and it stores events in structured manner which in turn helps identifying errors and in crash recovery. + The journal is a centralized, unified storage system for log data from all sources. It stores events in a structured manner, which helps with error identification and crash recovery. @@ -35,8 +35,8 @@ If systemd-journald is configured to store the logs in a persistent - manner, you can find the journal in /var/log/journal. Ensure that the - directoy exists: + manner, you can find the journal in /var/log/journal. See if the + directory is there: @@ -59,7 +59,7 @@ journal - Set correct ownership and access perimissions: + Set the correct ownership and access permissions: &prompt.sudo; systemd-tmpfiles --create --prefix=/var/log/journal @@ -75,7 +75,7 @@ journal
- The journal logs structure + The journal log structure The logs are stored in binary format across several files. To view the structure of a log entry, proceed as follows: @@ -110,12 +110,12 @@ journal Timestamp -The exact time the event occured +The exact time the event occurred - Source Fields + Source fields @@ -127,7 +127,7 @@ The exact time the event occured - System Fields + System fields _SYSTEMD_UNIT: The systemd unit (service) that generated the @@ -137,8 +137,8 @@ The exact time the event occured - Kernel Fields - _TRANSPORT: How the message was logged (e.g., kernel, syslog, stdout). + Kernel fields + _TRANSPORT: How the message was logged (e.g., kernel, syslog, stdout) Priority level diff --git a/references/journalctl-usage.xml b/references/journalctl-usage.xml index 1f9ff7977..13638a9f3 100644 --- a/references/journalctl-usage.xml +++ b/references/journalctl-usage.xml @@ -28,7 +28,7 @@ This section describes the generic usage of the journalctl co - Running the journalctl without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. + Running journalctl without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. The general syntax of the journalctl command is as follows: @@ -43,7 +43,7 @@ This section describes the generic usage of the journalctl co &prompt.sudo;journalctl /usr/lib/systemd/systemd - Running the command without any options displays all logged messages, usually starting from the oldest, and pipes the output through a pager (like less) for easy navigation. + Listed below are the common useful options to enhance the default journalctl behavior: diff --git a/tasks/journald-configure.xml b/tasks/journald-configure.xml index 2ef46a909..83f34bb0d 100644 --- a/tasks/journald-configure.xml +++ b/tasks/journald-configure.xml @@ -76,7 +76,7 @@ ForwardToSyslog=yes &prompt.sudo; systemctl restart systemd-journald - To limit logs rate to prevent flooding logs: + To limit the log rate to prevent flooding logs: RateLimitIntervalSec=30s RateLimitBurst=1000 @@ -88,13 +88,13 @@ RateLimitBurst=1000 TTYPath=/dev/tty12 - To forward logs to syslog, modify ForwardToSyslog=yes.Journald is backward compatible with traditional syslog implementations such as rsyslog. + To forward logs to syslog, modify ForwardToSyslog=yes. journald is backward compatible with traditional syslog implementations such as rsyslog. - Install rsyslogrpm -q rsyslog - Enable rsyslogsystemctl is-enabled rsyslog - Enable forwarding to rsyslog in /etc/systemd/journald.confForwardToSyslog=yes + Install rsyslog:rpm -q rsyslog + Enable rsyslog:systemctl is-enabled rsyslog + Enable forwarding to rsyslog in /etc/systemd/journald.conf:ForwardToSyslog=yes - For more information on file description, see man 5 journald.conf. + For more information on file descriptions, see man 5 journald.conf. diff --git a/tasks/journald-filter-journals.xml b/tasks/journald-filter-journals.xml index 85f6285c3..a6743dd7f 100644 --- a/tasks/journald-filter-journals.xml +++ b/tasks/journald-filter-journals.xml @@ -22,16 +22,16 @@ in the assembly --> - This section describes how to refine the search in logs according to boot numbers, for specific time interval or to view specific data fields. - content of the journal, the oldest entries listed first. The output can be - filtered by specific switches and fields. + This section describes how to refine searches in logs, for example, by boot number, + by a specific time interval, or to view specific data fields. By default, the journal lists + the oldest entries first. The output can be filtered using specific switches and fields. - You can filter journals based on boot number, time interval, and fields. For details refer to following sections. + You can filter journals based on boot number, time interval, and fields. For details, refer to the following sections.
- Filter logs based on specific system boot + Filter logs based on a specific system boot To list logs for all the available boots, run the command as follows: @@ -51,7 +51,7 @@ in the assembly -->
Filtering logs based on time interval - You can filter the output of journalctl by specifying the starting and/or ending date. The date specification should be of the formatYYYY-MM-DD H:MM:SS. If the time part is omitted, midnight is assumed. If seconds are omitted, :00 is assumed. If the date part is omitted, the current day is assumed. Instead of numeric expression, you can specify the keywords yesterday, + You can filter the output of journalctl by specifying the starting and/or ending date. The date specification should be of the format YYYY-MM-DD H:MM:SS. If the time part is omitted, midnight is assumed. If seconds are omitted, :00 is assumed. If the date part is omitted, the current day is assumed. Instead of a numeric expression, you can specify the keywords yesterday, today or tomorrow. They refer to midnight of the day before the current day, of the current day, or of the day after the current day. If you specify now, it refers to the current time. You can also specify relative times @@ -60,7 +60,7 @@ in the assembly --> To view only new messages since now, and update the output continuously: &prompt.sudo;journalctl --since "now" -f - To view all messages since last midnight till 3:20am: + To view all messages since last midnight until 3:20am: &prompt.sudo;journalctl --since "today" --until "3:20"
diff --git a/tasks/systemd-journald-troubleshooting.xml b/tasks/systemd-journald-troubleshooting.xml index ef6d25296..2b69d8d89 100644 --- a/tasks/systemd-journald-troubleshooting.xml +++ b/tasks/systemd-journald-troubleshooting.xml @@ -30,10 +30,10 @@ in the assembly --> View the list of failed &systemd; units: systemctl --failed -The list of all failed services appear. +The list of all failed services appears. Identify the severity and content of the error. journalctl -p 0..7 -b - The list of errors with priority level 0 to 7 appears. The errors are marked with priority level: + The list of errors with priority levels 0 to 7 appears. The errors are marked with priority level: 0-2: emerg, alert, crit: Critical issues, system collapse imminent. @@ -44,16 +44,17 @@ in the assembly --> View the error log for the failing service using the following command: journalctl -u <failing_service_name> -The lines preceding the termination message includes information on the error. +The lines preceding the termination message include information about the error. - Exit Status: f a service stops, look for a message like Process xxx exited with status 1/FAILURE. A status of 0 is success. Any non-zero status indicates an error. - Configuration Errors: Messages containing phrases like No such file or directory, Permission denied, or Address already in use usually point to a problem in the service's configuration file - Out-of-Memory (OOM): Out-of-Memory (OOM) + Exit Status: If a service stops, look for a message like Process xxx exited with status 1/FAILURE. A status of 0 indicates success. Any nonzero status indicates an error. + Configuration Errors: Messages containing phrases like No such file or directory, Permission denied or Address already in use usually point to a problem in the service's configuration file. + Out-of-Memory (OOM): The service was terminated because + it exceeded memory limits. -Use detailed views of logs to get detailed information on the error. +Use detailed views of logs to get detailed information about the error. journalctl -xe -For example, to view all messages from the Apache service during the current boot, with detailed explanations, run the following command: +For example, to view all messages from the Apache service during the current boot with detailed explanations, run the following command: journalctl -u httpd.service -b -xe
From 3e8e782b39bad0d5f649e6d746d7265f90391e7c Mon Sep 17 00:00:00 2001 From: Shalaka Harne <135588263+harneshalaka@users.noreply.github.com> Date: Thu, 11 Dec 2025 21:17:49 +0530 Subject: [PATCH 32/32] Update articles/journalctl.asm.xml Fixed editorial feedback Co-authored-by: Daria Vladykina --- articles/journalctl.asm.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/articles/journalctl.asm.xml b/articles/journalctl.asm.xml index 5d3b993c8..0e4165cb8 100644 --- a/articles/journalctl.asm.xml +++ b/articles/journalctl.asm.xml @@ -69,7 +69,7 @@ Initial version Learn how to view and manage &productnameshort; logs using journalctl -Mastering System Logs: From systemd-journald to journalctl +View and filter logs with journalctl Configuration