In this video, you'll learn about systemd journald.
So what is systemd journald?
Well, the systemd journal handles log messages
that are generated by any systemd unit.
Which kind of makes sense.
Systemd is taking care of everything.
And as it is taking care of everything,
it also sees all messages generated
by everything on your system.
And that is why systemd journald was introduced
as a generic log service.
Now, the first level of getting information
about your services in systemd is
by just typing systemctl status on your unit.
Use systemctl status sshd.service, for instance,
to see the most recent messages that
have been logged by that service.
You can also use journalctl.
Journalctl prints a complete journal.
And it has some nice filtering options.
These include minus F, which will follow the journal
while new messages are added.
Or minus PR, where you will only print events with a priority
of error and higher.
Also pretty powerful is using minus since,
followed by a time indicator, until followed by a time
indicator as well.
So that you can find messages from a specific time frame.
If it's not enough, use journalctl minus over both
for more details.
Or minus U, which prints events for a specific unit.
If you want more information about all of them,
systemd has a nice man page that you can find
in systemd.journal-fields.
I'm going to demonstrate a couple of them,
my personal favorites.
So here we have journalctl.
Journalctl is showing its output in a less like pager,
where you can use your spacebar to scroll down or uppercase G
to go all the way down.
Now, what I really like is my filtering options,
like journalctl minus U sshd, which is showing it
for the sshd unit.
Kind of boring.
You can also add the X, so minus X U sshd, where
X is giving some explanation.
Now, don't expect too much of this explanation,
but it might just be what you need in order to figure out
what is really going on.
Now, related to that, you can also
use journalctl minus XB.
Minus XB is showing the boot log, all the messages that
are logged since booting.
Or what do you think of journalctl minus minus D
message?
D message is reading the kernel log.
The kernel logs are written to a specific area of memory.
And before, you would use a separate command D message,
which, by the way, still works.
And as you can see, it's even nicer.
It's showing nice colors.
And it's showing a time offset in the beginning.
If you're wondering what is this,
well, this is the number of seconds
since the system booted that the message has been generated.
There's something else we need to discuss regarding
journalctl, because it's not persistent by default.
The disadvantage of the system D journal
is that it is not persistent by default.
So you reboot, you lose it.
But you can make it persistent if you want to.
And it's actually pretty simple.
When in the journal.conf, the option storage is always set,
a persistent journal will be created
after you create a directory with the name var log journal.
But you will have to use a systemctl restart system
journal flush command to trigger system D to reload
its configuration.
Up to that moment, your journal won't be persistent.
Let me show you.
So let's start by using find slash minus name journald.conf.
And that is because the name of the configuration file
might be different on your distribution.
So here we have user lib systemd journald.conf.
With all of the different options
that apply to the journal, including storage is auto.
No need to change anything.
Let's just make this journal persistent.
So I'm going to use mkdir var log journal.
And that creates a directory journal.
But ls on var log journal is not showing anything by default.
And that is because we need to trigger it.
Now systemd nowadays is quite strong
at picking up modifications without having
to reboot anything.
And it's kind of weird that this modification
needs a specific command.
And that is systemctl restart systemd-journal-flush.
And now if I use my ls in var log journal again,
there you can see a directory.
And that is a directory where my persistent journal
is going to be.
And that means that from now on, everything in the journal
is assistantly written to disk.
It will follow the restrictions that
are in the journald.conf file.
So if you are worried that your system is going to be filled up
or that messages are going to be cut off too easy,
have a look at the journald.conf file.