Learn how to - How to filter systemd logs using journalctl with examples

Felix Williams How to Logging February 9, 2023

Learn how to – How to filter systemd logs using journalctl with examples.

Logs are files that contain important system information. This information includes services, applications, and the kernel. There are several log files that contain different information. For example, there is a system log file containing security messages and cron jobs.

There are 3 methods used by services to write logs. There are:

Direct write – Services write information directly to the log files. These include Apache, Samba e.t.c
rsyslogd – can be described as the enhancement of syslogd. Syslogd is a traditional Linux daemon manager installed from the sysklogd package. With several improvements, rsyslogd was introduced to manage centralized logs.
journald – it came along with the introduction of systems. This service is integrated with systems and allows system admins to obtain detailed information from the journal when managing services with the systemctl statuscommand.

Understanding systemd journald

The systemd-journalddaemon collects and stores log information that comes from several sources. These journal entries are normally gathered from server messages, kernel messages, and user-mode program messages. It stored the journal entries notwithstanding their metadata, size, or format. The event journal is then stored in binary format and can be accessed using the journalctlcommand. The binary files are stored under /run/log/journal or /var/log/journal.

This guide offers a deep illustration of how to filter systemd logs using journalctl with examples.

Configuring Journalctl

Journalctl can be configured to give you the desired service. The configurations you can do are explained below.

Permissions

Journalctl allows one to view logs as the root user. To see messages for other users and perform log operations as a regular user, you need to add your user to the systemd-journal group.

The command used is:

sudo usermod -aG systemd-journal $USER

Persisting logs in Systemd journald

The logs are normally stored in a persistent path /var/log/journal. If the path is present, the logs will survive a system reboot. Otherwise, you can create the path and enable a persistent journal using the commands:

sudo mkdir -p /var/log/journal
sudo chown root:systemd-journal /var/log/journal
sudo chmod 2755 /var/log/journal
sudo killall -USR1 systemd-journald

Verify if the path has been created correctly using the tree command:

$ sudo yum -y install tree
$ tree /var/log/journal
/var/log/journal
└── 9f4f62f8fec1487b98405a80137dfcef
    └── system.journal

1 directory, 1 file

Another method to enable persistent logging is by editing the conf file and set the storage path:

By default, the storage is set to auto as below:

$ cat /etc/systemd/journald.conf | grep Storage
#Storage=auto

Edit this to persistent as below.

$ sudo vi /etc/systemd/journald.conf
[Journal]
Storage=persistent

Restart journald service

sudo systemctl restart systemd-journald.service

How to use Journalctl with Systemd on Linux

Now with the desired configurations, you can use Journalctl to view and filter the systemd logs.

1. Basic Usage

To show all journal entries, use the command:

journalctl

This command will output all the logs generated on the system. The utility can be used with several flags to filter the logs. Some of the flags used are elucidated below.

2. View journal logs runtime

Just like tail -f you can view logs in live mode with Journalctl. The command allows you to view new systemd-journald messages in real-time. The command used is:

journalctl -f

To interrupt the command, use Ctrl+C.

3. Show boot-related messages

With Journalctl, you can view boot-related messages. To view messages of the current boot, use:

journalctl -b

You can also list the previous boot messages using the command below. But this needs a persistent journal configured.

$ journalctl --list-boots
 0 8ce572d58a6247a9b9cf57c4efd67624 Fri 2022-04-15 09:27:55 EDT—Fri 2022-04-15 >

Once listed, view detailed information about the boot. For his guide, we will view logs from the 0 offset:

$ journalctl -b 0
-- Logs begin at Fri 2022-04-15 09:27:55 EDT, end at Fri 2022-04-15 09:33:32 EDT. --
Apr 15 09:27:55 localhost.localdomain kernel: Linux version 4.18.0-348.20.1.el8_5.x86_64 (mockbuild@koji.corp.cloudlinux.com) (gcc version >
Apr 15 09:27:55 localhost.localdomain kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-348.20.1.el8_5.x86_64 root=/dev/mapper/a>
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'compacted' format.
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-provided physical RAM map:
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x0000000000100000-0x000000007ffdbfff] usable
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x000000007ffdc000-0x000000007fffffff] reserved
.....

4. Filter systemd logs based on timestamp

You can view systems logs by filtering them based on timestamp. Some of the arguments used are;

$ journalctl --since today
-- Logs begin at Fri 2022-04-15 09:27:55 EDT, end at Fri 2022-04-15 09:33:32 EDT. --
Apr 15 09:27:55 localhost.localdomain kernel: Linux version 4.18.0-348.20.1.el8_5.x86_64 (mockbuild@koji.corp.cloudlinux.com) (gcc version >
Apr 15 09:27:55 localhost.localdomain kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-348.20.1.el8_5.x86_64 root=/dev/mapper/a>
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'compacted' format.
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-provided physical RAM map:

You can as well check previous logs:

$ journalctl --since "2022-04-14 01:00:00"
-- Logs begin at Fri 2022-04-15 09:31:33 EDT, end at Fri 2022-04-15 09:31:33 EDT. --
Apr 15 09:31:33 localhost.localdomain systemd[2183]: Starting Mark boot as successful...
Apr 15 09:31:33 localhost.localdomain systemd[2183]: Started Mark boot as successful.

View logs between a given time period.

journalctl --since "2022-04-14 01:00:00" --until "2022-04-15 11:00:00"

View logs from yesterday:

journalctl --since yesterday --until now

5. Filter messages based on unit file

The -u flag is used to specify the service you are looking for. For example, checking logs for the SSHD service:

$ journalctl -u sshd.service
-- Logs begin at Fri 2022-04-15 09:27:55 EDT, end at Fri 2022-04-15 09:37:54 EDT. --
Apr 15 09:28:01 localhost.localdomain systemd[1]: Starting OpenSSH server daemon...
Apr 15 09:28:01 localhost.localdomain sshd[1044]: Server listening on 0.0.0.0 port 22.
Apr 15 09:28:01 localhost.localdomain sshd[1044]: Server listening on :: port 22.
Apr 15 09:28:01 localhost.localdomain systemd[1]: Started OpenSSH server daemon.
Apr 15 09:28:52 localhost.localdomain sshd[2177]: Accepted password for alma from 192.168.232.3 port 43500 ssh2
Apr 15 09:28:52 localhost.localdomain sshd[2177]: pam_unix(sshd:session): session opened for user alma by (uid=0)

You can as well specify the service using the _SYSTEMD_UNIT argument.

$ journalctl _SYSTEMD_UNIT=sshd.service
-- Logs begin at Fri 2022-04-15 09:27:55 EDT, end at Fri 2022-04-15 09:37:54 EDT. --
Apr 15 09:28:01 localhost.localdomain sshd[1044]: Server listening on 0.0.0.0 port 22.
Apr 15 09:28:01 localhost.localdomain sshd[1044]: Server listening on :: port 22.
Apr 15 09:28:52 localhost.localdomain sshd[2177]: Accepted password for alma from 192.168.232.3 port 43500 ssh2
Apr 15 09:28:52 localhost.localdomain sshd[2177]: pam_unix(sshd:session): session opened for user alma by (uid=0)

6. Filter logs based on Binary file

You can use the binary file that interacts with the service unit to view logs. For example for the sshd unit, the command will be:

$ journalctl /sbin/sshd
-- Logs begin at Fri 2022-04-15 09:27:55 EDT, end at Fri 2022-04-15 09:37:54 EDT. --
Apr 15 09:28:01 localhost.localdomain sshd[1044]: Server listening on 0.0.0.0 port 22.
Apr 15 09:28:01 localhost.localdomain sshd[1044]: Server listening on :: port 22.
Apr 15 09:28:52 localhost.localdomain sshd[2177]: Accepted password for alma from 192.168.232.3 port 43500 ssh2
Apr 15 09:28:52 localhost.localdomain sshd[2177]: pam_unix(sshd:session): session opened for user alma by (uid=0)

7. View more log details.

Detailed messages with explanations can be viewed by adding the -x to help you understand the logs. For example, a detailed message for the SSHD service can be viewed below;

$ journalctl -u sshd.service -x
-- Logs begin at Fri 2022-04-15 09:27:55 EDT, end at Fri 2022-04-15 09:37:54 EDT. --
Apr 15 09:28:01 localhost.localdomain systemd[1]: Starting OpenSSH server daemon...
-- Subject: Unit sshd.service has begun start-up
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
-- 
-- Unit sshd.service has begun starting up.
Apr 15 09:28:01 localhost.localdomain sshd[1044]: Server listening on 0.0.0.0 port 22.
Apr 15 09:28:01 localhost.localdomain sshd[1044]: Server listening on :: port 22.
Apr 15 09:28:01 localhost.localdomain systemd[1]: Started OpenSSH server daemon.
-- Subject: Unit sshd.service has finished start-up
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
-- 
-- Unit sshd.service has finished starting up.
-- 
-- The start-up result is done.
Apr 15 09:28:52 localhost.localdomain sshd[2177]: Accepted password for alma from 192.168.232.3 port 43500 ssh2
Apr 15 09:28:52 localhost.localdomain sshd[2177]: pam_unix(sshd:session): session opened for user alma by (uid=0)

8. Filter logs with Process PID| Users or Group ID

You can also filter the logs to be viewed based on the process PID. For example;

$ journalctl _PID=1044
-- Logs begin at Fri 2022-04-15 09:27:55 EDT, end at Fri 2022-04-15 09:39:49 EDT. --
Apr 15 09:28:01 localhost.localdomain sshd[1044]: Server listening on 0.0.0.0 port 22.
Apr 15 09:28:01 localhost.localdomain sshd[1044]: Server listening on :: port 22.

To filter logs based on the user, begin by identifying the user ID as below. Say for a user thor.

$ id alma
uid=1000(alma) gid=1000(alma) groups=1000(alma),190(systemd-journal)

Now you can filter logs based on the user ID.

$ journalctl _UID=1000
-- Logs begin at Fri 2022-04-15 09:27:55 EDT, end at Fri 2022-04-15 09:39:49 EDT. --
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Reached target Paths.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Listening on Multimedia System.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Listening on Sound System.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Starting D-Bus User Message Bus Socket.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Started Mark boot as successful after the user session has run 2 minutes.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Reached target Timers.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Listening on D-Bus User Message Bus Socket.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Reached target Sockets.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Reached target Basic System.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Starting Sound Service...
Apr 15 09:28:53 localhost.localdomain systemd[2183]: Started D-Bus User Message Bus.
Apr 15 09:28:53 localhost.localdomain systemd[2183]: Started Sound Service.
Apr 15 09:28:53 localhost.localdomain systemd[2183]: Reached target Default.
Apr 15 09:28:53 localhost.localdomain systemd[2183]: Startup finished in 652ms.
...

You can also view logs for the current user with the command

$ journalctl _UID=$(id -u)
-- Logs begin at Fri 2022-04-15 09:27:55 EDT, end at Fri 2022-04-15 09:39:49 EDT. --
Apr 15 09:27:55 localhost.localdomain systemd-journald[311]: Journal started
Apr 15 09:27:55 localhost.localdomain systemd-journald[311]: Runtime journal (/run/log/journal/9f4f62f8fec1487b98405a80137dfcef) is 8.0M, m>
Apr 15 09:27:55 localhost.localdomain systemd-modules-load[307]: Inserted module 'fuse'
Apr 15 09:27:55 localhost.localdomain systemd-modules-load[307]: Module 'msr' is builtin
Apr 15 09:27:55 localhost.localdomain rngd[310]: Initializing available sources
Apr 15 09:27:55 localhost.localdomain rngd[310]: [hwrng ]: Initialization Failed
Apr 15 09:27:55 localhost.localdomain rngd[310]: [rdrand]: Enabling RDSEED rng support
Apr 15 09:27:55 localhost.localdomain rngd[310]: [rdrand]: Initialized
Apr 15 09:27:55 localhost.localdomain rngd[310]: [jitter]: Initializing AES buffer
Apr 15 09:27:56 localhost.localdomain systemd[1]: systemd-vconsole-setup.service: Succeeded.
Apr 15 09:27:56 localhost.localdomain systemd[1]: Started Setup Virtual Console.
Apr 15 09:27:56 localhost.localdomain systemd[1]: Starting dracut cmdline hook...
Apr 15 09:27:56 localhost.localdomain dracut-cmdline[337]: dracut-8.5 (Arctic Sphynx) dracut-049-191.git20210920.el8
Apr 15 09:27:56 localhost.localdomain dracut-cmdline[337]: Using kernel command line parameters: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-348>
Apr 15 09:27:56 localhost.localdomain systemd[1]: Started dracut cmdline hook.

To filter logs based on the GID, use the command:

$ journalctl _GID=1000
-- Logs begin at Fri 2022-04-15 09:27:55 EDT, end at Fri 2022-04-15 09:39:49 EDT. --
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Reached target Paths.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Listening on Multimedia System.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Listening on Sound System.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Starting D-Bus User Message Bus Socket.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Started Mark boot as successful after the user session has run 2 minutes.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Reached target Timers.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Listening on D-Bus User Message Bus Socket.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Reached target Sockets.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Reached target Basic System.
Apr 15 09:28:52 localhost.localdomain systemd[2183]: Starting Sound Service...

9. Filter logs by Priority

When filtering logs based on propriety, the -p flag is used. This flag also takes the priority name or its numeric value such as:

0 – emerg
1- alert
2 – crit
3 – err
4 – warning
5 – notice
6 – info
7 – debug

For example, to filter logs for the debug priority, the command will be:

$ journalctl -p 7
-- Logs begin at Fri 2022-04-15 09:27:55 EDT, end at Fri 2022-04-15 09:39:49 EDT. --
Apr 15 09:27:55 localhost.localdomain kernel: Linux version 4.18.0-348.20.1.el8_5.x86_64 (mockbuild@koji.corp.cloudlinux.com) (gcc version >
Apr 15 09:27:55 localhost.localdomain kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-348.20.1.el8_5.x86_64 root=/dev/mapper/a>
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'compacted' format.
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-provided physical RAM map:
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x0000000000100000-0x000000007ffdbfff] usable
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x000000007ffdc000-0x000000007fffffff] reserved
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000b0000000-0x00000000bfffffff] reserved
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000fed1c000-0x00000000fed1ffff] reserved
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
....

You can as well view logs for a range say, emerg(0) and critical(2):

$ journalctl -p 0..2
-- Logs begin at Fri 2022-04-15 09:27:55 EDT, end at Fri 2022-04-15 09:43:15 EDT. --
Apr 15 09:28:00 localhost.localdomain smartd[887]: In the system's table of devices NO devices found to scan

10. Filter Kernel Messages

The Kernel messages can be viewed as below:

$ journalctl -k
-- Logs begin at Fri 2022-04-15 09:27:55 EDT, end at Fri 2022-04-15 09:43:15 EDT. --
Apr 15 09:27:55 localhost.localdomain kernel: Linux version 4.18.0-348.20.1.el8_5.x86_64 (mockbuild@koji.corp.cloudlinux.com) (gcc version >
Apr 15 09:27:55 localhost.localdomain kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-348.20.1.el8_5.x86_64 root=/dev/mapper/a>
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'compacted' format.
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-provided physical RAM map:
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x0000000000100000-0x000000007ffdbfff] usable
.....

alternatively, you can use the _TRANSPORT flag for the kernel logs as below.

$ journalctl _TRANSPORT=kernel
-- Logs begin at Fri 2022-04-15 09:27:55 EDT, end at Fri 2022-04-15 09:43:15 EDT. --
Apr 15 09:27:55 localhost.localdomain kernel: Linux version 4.18.0-348.20.1.el8_5.x86_64 (mockbuild@koji.corp.cloudlinux.com) (gcc version >
Apr 15 09:27:55 localhost.localdomain kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-348.20.1.el8_5.x86_64 root=/dev/mapper/a>
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
Apr 15 09:27:55 localhost.localdomain kernel: x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'compacted' format.
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-provided physical RAM map:
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x0000000000100000-0x000000007ffdbfff] usable
Apr 15 09:27:55 localhost.localdomain kernel: BIOS-e820: [mem 0x000000007ffdc000-0x000000007fffffff] reserved
........

11. Check disk and Memory usage by Journal logs and perform Clean Up

If you have set persistent logging, the amount of disk utilized can be shown as below:

$ journalctl --disk-usage
Archived and active journals take up 206.0M in the file system.

For those who haven’t configured persistent logging, the above command displayed the memory used.

The disk can be cleaned using the --vaccum-sizecommand. For example, reducing the journal file usage to 200 MB, the command will be:

$ journalctl --vacuum-size=200M
Deleted archived journal /run/log/journal/9bf0fc6f60ce41149a0a540f52db9773/system@822262d9c350464d9b67a3fd4fa4b8d8-00000000003bf4d9-000591cb0a1ae4c4.journal (6.0M).
Vacuuming done, freed 6.0M of archived journals on disk.

Verify if the changes have been made:

$ journalctl --disk-usage
Archived and active journals take up 200.0M on disk.

12. View Logs in Verbose Mode

Systemd can be viewed in verbose Mode with the command:

$ journalctl -o verbose
-- Logs begin at Fri 2022-04-15 09:27:55 EDT, end at Fri 2022-04-15 09:43:15 EDT. --
Fri 2022-04-15 09:27:55.664729 EDT [s=b7740adaec2e45a7ae7671427226140e;i=1;b=8ce572d58a6247a9b9cf57c4efd67624;m=105783;t=5dcb160d85159;x=6f>
    _SOURCE_MONOTONIC_TIMESTAMP=0
    _TRANSPORT=kernel
    PRIORITY=5
    SYSLOG_FACILITY=0
    SYSLOG_IDENTIFIER=kernel
    MESSAGE=Linux version 4.18.0-348.20.1.el8_5.x86_64 (mockbuild@koji.corp.cloudlinux.com) (gcc version 8.5.0 20210514 (Red Hat 8.5.0-4) (>
    _BOOT_ID=8ce572d58a6247a9b9cf57c4efd67624
    _MACHINE_ID=9f4f62f8fec1487b98405a80137dfcef
    _HOSTNAME=localhost.localdomain
Fri 2022-04-15 09:27:55.667768 EDT [s=b7740adaec2e45a7ae7671427226140e;i=2;b=8ce572d58a6247a9b9cf57c4efd67624;m=106362;t=5dcb160d85d38;x=50>
    _SOURCE_MONOTONIC_TIMESTAMP=0
    _TRANSPORT=kernel
    SYSLOG_FACILITY=0
    SYSLOG_IDENTIFIER=kernel
    _BOOT_ID=8ce572d58a6247a9b9cf57c4efd67624
    _MACHINE_ID=9f4f62f8fec1487b98405a80137dfcef
    _HOSTNAME=localhost.localdomain
    PRIORITY=6
    MESSAGE=Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-348.20.1.el8_5.x86_64 root=/dev/mapper/almalinux-root ro crashkernel=auto >
Fri 2022-04-15 09:27:55.667783 EDT [s=b7740adaec2e45a7ae7671427226140e;i=3;b=8ce572d58a6247a9b9cf57c4efd67624;m=106371;t=5dcb160d85d47;x=22>
    _SOURCE_MONOTONIC_TIMESTAMP=0
    _TRANSPORT=kernel
    SYSLOG_FACILITY=0
    SYSLOG_IDENTIFIER=kernel
    _BOOT_ID=8ce572d58a6247a9b9cf57c4efd67624
    _MACHINE_ID=9f4f62f8fec1487b98405a80137dfcef
    _HOSTNAME=localhost.localdomain
    PRIORITY=6
    MESSAGE=x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
...

The end!

I hope the guide has been significant. This guide has provided only a few examples on how to filter systemd logs using journalctl. There are more other uses of journalctl found on the journalctl man page.

Cart

Learn how to – How to filter systemd logs using journalctl with examples