All Questions
Tagged with systemd-journald journalctl
53 questions
0
votes
1
answer
7
views
Cannot see "file,line,func" fields in the journal
I am trying to use sd_journal_print_with_location() function.
#include <systemd/sd-journal.h>
int main() {
sd_journal_print_with_location(LOG_INFO, "CODE_FILE=tst_file.c", "...
- 5,187
0
votes
1
answer
47
views
How to tail remote systemd journal files
I've gotten my systemd-journald-remote.service up and running, with (1) test client connecting successfully via systemd-journald-upload.service. When I normally tail journald logs, I use journalctl -...
- 3,474
0
votes
0
answers
35
views
JournalD leaving 4GB free while I have specifically configured to leave 20% that is around 25GB?
I have configurad journald with following conf,
[test@mcmillan ~]# cat /etc/systemd/journald.conf
[Journal]
Storage=persistent
Compress=True
RateLimitInterval=1s
RateLimitBurst=10000
SyncIntervalSec=...
- 101
0
votes
0
answers
27
views
Is it impossible to limit journalctl to a user service?
I am specifically NOT asking about how a user can look at their own logs, I am asking how at root level, where I see user service logs with a plain call to sudo journalctl --output with-unit like so:
...
- 131
7
votes
2
answers
1k
views
Is it possible to dynamically refresh journalctl with less?
I'm using less to view my journalctl logs because it's more convenient. It doesn't clutter the console window with logs after you exit less and you can scroll using your mouse wheel.
journalctl --unit ...
- 73
1
vote
0
answers
781
views
Why jouranlctl uses --utc by default when running without root privigies?
On a host running Ubuntu 20.04 LTS I notice that, by default, journalctl (without root privileges) is the same as journalctl --utc, but with root privileges journalctl honors the time zone (as shown ...
- 2,962
0
votes
0
answers
803
views
systemd, journalctl, and suspend/resume (sleep/wake): marked by default in the logs? Or how to add? And scripting around suspend/resume in general?
(
First of all, I'm not completely sure what the official terms are.
I think it's "suspend"/"resume",
with "sleep"/"wake" being synonyms
(and I'm not sure if ...
- 23
0
votes
1
answer
710
views
How to filter journalctl logs by human readable facility?
I can do the following to get local3 logs:
journalctl SYSLOG_FACILITY=19
The magic number 19 is uterly confusing. How can I do the following:
journalctl WHAT_TO_PUT_HERE=local3
?
I do not see ...
- 880
4
votes
2
answers
1k
views
What are the .journal files that have a ~ on the end?
I have some files in my /var/log/journal/f7e928ba68a9449e85bd828252981fc6/ that have a .journal~ extension.
Can I remove these?
example:
-rw-r-----+ 1 root systemd-journal 16777216 Dec 21 08:46 ...
- 63
0
votes
1
answer
269
views
Why is a gap between `journalctl -k -b -0` and `ps ho lstart 1`?
I encounter a strange observation:
If I do: journalctl -k -b -0 | sed -e 's/^\(.\{76\}\).*/\1.../;3q'
I will see something like:
-- Journal begins at Sun 2022-08-07 12:06:55 CEST, ends at Mon 2023-02-...
5
votes
0
answers
13k
views
systemd-journal is using 100% cpu
This is the result of top command
I caught it at 99.7% but It even uses 170%. this is the output of journalctl
I thought it is something related to Bluetooth, so I turned it off but still got the ...
- 397
0
votes
1
answer
490
views
Why does journaltcl logs start only today when the last reboot was done 5 days before?
Why does journaltcl logs start only today when the last reboot was done 5 days before ? :
$ journalctl -e | grep Logs.begin
-- Logs begin at Tue 2022-09-06 09:42:37 CEST, end at Tue 2022-09-06 11:04:...
- 2,341
2
votes
1
answer
1k
views
How to display echo messages from a systemd-timer script in journalctl?
I run via a systemd timer a shell script that starts some programs (they display some output) and uses echo to provide some feedback.
root@srv ~ [127]# cat /etc/systemd/system/borg.timer
[Unit]
...
- 1,635
6
votes
4
answers
9k
views
How to keep systemd journal for one year?
By default my system had about ~500MB max size which had about 1 month of logs.
System Journal (/var/log/journal/dd35c7606a5645c5acc9908470c45159) is 483.2M, max 491.5M, 8.2M free.
No idea how the ...
- 4,537
3
votes
2
answers
641
views
How to follow systemd journald logs for template units that come and go (i.e. socket-activated units)?
I have a inetd-style service deployed as a systemd socket unit and its accompanying service unit, say, my-service.socket with Accept=true and [email protected].
Each time a new connection is ...
1
vote
1
answer
427
views
What causes journal logs to end with tilde (~)? [duplicate]
Many of my journal log files consistently are named ending with tilde, e.g. -
/var/log/journal/dc104498c02e4392903c4b68c856a662 $ ls -ltrh
total 768M
-rw-r-----+ 1 root systemd-journal 8.0M Jun 11 11:...
- 113
0
votes
1
answer
3k
views
journald RuntimeMaxUse is ignored, quota tied to RuntimeMaxFileSize instead
Setup
Using systemd 244 (244.5+) on kernel 4.19.62.
I want to set the total journal storage size to 100MB. Journald is set to volatile storage, so logs end up on /run/log/journal/... and RuntimeMaxUse ...
3
votes
1
answer
530
views
Logs partly lost after crash
I am trying to fix an issue with PM (suspend) on my laptop,
therefore I enabled some logging for my kernel (pm_debug_messages) to look at it afterwards using journalctl.
The problem is:
Whenever my ...
- 338
2
votes
1
answer
2k
views
How is journalctl able to add the line with the "-- Reboot --" log message?
I've noticed, on machines where the journalctl logs are saved on disk, that on a reboot, I get a line between the message before and after the reboot happened like so:
blah
blah
blah
-- Reboot --
blah
...
- 3,019
2
votes
1
answer
516
views
Can I migrate ubuntu journald logs?
I have an app registered as a service in Ubuntu 16.04
If I type:
journalctl -u myapp.service
I can see the logs for my app.
I am moving my app to a new VM where the same service will be in place. Is ...
- 123
2
votes
1
answer
311
views
journal files quite big, hidden content?
I'm running Ubuntu 20.04 on a server. Currently my /var/log/journal folder grows rapidly (about 1Gb in a week) and I don't understand why.
If I check the logs with journalctl I cannot see any major ...
- 121
2
votes
1
answer
477
views
What will a boot look like in the systemd journal (journalctl)?
What should I look for in the systemd journal to find when the latest boot happened?
- 1,386
2
votes
0
answers
426
views
Can you set a capture filter on journald?
I have a service that runs in the background. It's controlled by systemd. Any output is captured by journald.
Most of the time, it has very little output. Sometimes though, it runs into a particular ...
- 477
4
votes
2
answers
13k
views
How to detect and clean up junk journal files?
One of our Ubuntu 18.04 hosts was caught with 12 GB of *.journal files, far more than intended. Attempting to find out if they were worth keeping, I ran
journalctl --file $f
on each file older than ...
- 513
1
vote
1
answer
239
views
journalctl - clear low priority messages
Is there a way to clear systemd/journal messages manually only keeping high priority messages?
I have a system with very limited storage and would like to keep the journal compact while still keeping ...
- 13
0
votes
2
answers
274
views
Is there a way to log program specific behavior?
Edited:
Since the initial question was too general I will focus on only one program.
I am running the command libinput-gestures-setup start, which comes bundled with libinput-gestures and it seems to ...
- 125
4
votes
2
answers
4k
views
'tail -F *.log' but with systemd
With normal syslog I can go to /var/log and run tail -F *log if I am not sure which log something is logged in.
Is there an equivalent for systemd?
Background
I am trying to debug a server. It crashes ...
- 36.6k
0
votes
1
answer
1k
views
journalctl: what does "New USB device found" mean?
Aug 17 02:16:44 <hostname> kernel: usb 1-2: new high-speed USB device number 13 using xhci_hcd
Aug 17 02:16:45 <hostname> kernel: usb 1-2: New USB device found, idVendor=05c6, idProduct=...
- 848
2
votes
0
answers
591
views
SystemD-JournalD Loses Track of Previous Boot Persistent Log Data
I am running SystemD JournalD version 244.3 on a custom Embedded Linux board.
root@board:/var/log/journal# journalctl --version
systemd 244 (244.3+)
-PAM -AUDIT -SELINUX +IMA -APPARMOR -SMACK +...
- 91
7
votes
4
answers
6k
views
systemd-journald persistent logs do not work with bind mount /var/log
I am using Yocto to produce a custom image for a small embedded Linux system with SystemD Version 241. The root file system is Read-Only. I am using bind mounts and overlayfs to make the /var/log/...
- 91
3
votes
2
answers
2k
views
How can find out where a system message originates ("testing the buffer" in dmesg / journalctl / messages)?
In the past few days I have had a message in the system log/journal over a thousand times within a second. How can I find out where it originated?
# journalctl --system | grep "testing the buffer" | ...
- 9,084
1
vote
0
answers
27
views
Consecutive same lines are squashed into one in journal
I am running as below:
% systemd-run --user python3 -c "print(1);print(1)"
Running as unit: run-r9210c54561b84cdbaf4e741f5d2f3e57.service
I was expecting to see two 1s in each line. But I am seeing ...
0
votes
0
answers
610
views
journalctl - How to clear until last boot?
I'm aware of journalctl's vacuum-time, vacuum-size and vacuum-files. Is there a way to do vacuum-boot or something similar? Yes, this can be accomplished by specifying a specific time, however, pin ...
- 1
3
votes
0
answers
230
views
How is a log inside bash or python script appended to a specific journald unit name?
How do logs and prints inside scripts (bash, python etc) get associated to a unit name?
Suppose I have a very simple unit file test-service.service
[Unit]
Description=Test Unit
[Service]
Type=...
- 43
0
votes
1
answer
3k
views
How do i get python to tail a logfile? Tried various methods
I'm trying to get python to tail a logfile e.g. syslog.
I've tried opening the file in read mode, but it never realises if another process writes to the file. Using a popen, and actual 'tail -f' ...
- 761
0
votes
0
answers
636
views
How to mount a partition's subdirectory for /var/log/journal?
Our server (Ubuntu 18) has a large partition mounted as /publish/data (its a VM, provided as IaaS so that is how it is mounted when extra disk space is requested), it is defined in fstab as follows:
/...
- 161
6
votes
1
answer
6k
views
How to let a specific group have read-access to systemd's journal?
How do I grant read-only permission to somegroup to read the system journal? (I'm on Debian10 buster).
$ journalctl
Hint: You are currently not seeing messages from other users and the system.
...
- 14.8k
0
votes
1
answer
795
views
Use journalctl to show logs of specific unit which has a parameter?
I have one systemd service which runs with systemctl --user start test_unit@random_arguments. How could I use journalctl to filter all logs of test_unit? If it supports "follow mode", that's even ...
- 103
10
votes
1
answer
7k
views
Getting systemd service logs faster from my service
I'm having a systemd service defined as follows, that works fine:
[Unit]
Description=my service
After=network.target
[Service]
User=myuser
Group=mygroup
WorkingDirectory=/home/myuser/myapp
...
- 261
4
votes
1
answer
1k
views
How do I work out which process/service/program is sending systemd dbus messages?
Currently my systemd journal is filling up with messages of the form:
Feb 01 16:40:31 host systemd[1]: Got message type=method_call
sender=:1.58666 destination=org.freedesktop.systemd1 object=/org
/...
- 496
14
votes
2
answers
3k
views
Remove single line from journalctl file
I have an Ubuntu 18.04 server that is running a service I'm developing. The output is being sent to the system journal for logging.
I accidentally failed to sanitize some logging and a plaintext ...
- 241
2
votes
2
answers
628
views
redundant systemd-journal-remote for systemd-journal-upload instances
I'm using systemd-journal-upload on serveral nodes to forward their journals to a single systemd-journal-remote sink, loghost01:
/var/log/journal
├── <foo-bar>
│ ├── system.journal
│ └── ...
- 121
12
votes
2
answers
13k
views
How to configure journald to discard entries older than a certain time span
From the documentation I know that I can configure
the time after which journal files are deleted via MaxRetentionSec.
the time after which journal files are rotated via MaxFileSec.
However my goal ...
- 1,519
5
votes
1
answer
3k
views
Why journalctl does not display log message if I use filtering by unit?
I'm using Ubuntu 16.04 and I am seeing some strange behavior when analyzing journalctl logs.
Here's unfiltered output (I used json output to hopefully include all relevant fields):
$ journalctl -o ...
- 6,443
3
votes
1
answer
4k
views
Prevent syslogs from being logged under journalctl
I have a simple Python snippet managed by a systemd service which logs to the rsysogd daemon where I've defined a configuration file to put it to a syslog server with a format I've defined. This is ...
- 13k
1
vote
0
answers
2k
views
systemd-journald missing crash logs
I am running Arch-ARM on RPi3. I have noticed when system crashes I cannot find any related crash log in journal logs.
Arch Linux ARM on RPi3: Linux 4.4.37-1-ARCH #1 SMP armv7l GNU/Linux
Systemd: ...
- 317
5
votes
3
answers
12k
views
Can I mask the systemd-journal-flush service and run journalctl --flush later manually?
On my archlinux installation, I realised that flushing the journal logs to disk by the systemd-journal-flush service significantly prolongs the boot process and masking the service improves boot time. ...
6
votes
1
answer
10k
views
Why `journalctl --list-boots` doesn't match what `uptime` and `who -b` report?
Here's a test script I used:
last_reboot=$(last reboot | grep 'still running' | awk '{for (i=5; i<=NF; i++) printf $i FS}' | awk '{for (i=1; i<=NF - 2; i++) printf $i FS}')
if [ "$last_reboot" ]...
- 3,513
2
votes
0
answers
831
views
Why journalctl outputs in ASCII?
I have a regular Ubuntu 16.04 server VM. My locale is set up to utf-8 everywhere:
$ locale
LANG=en_US.UTF-8
LANGUAGE=
LC_CTYPE="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_COLLATE="...
- 6,443
5
votes
1
answer
3k
views
journalctl shows very old boots which are not recycled
The system has very old boots (2 and 3 years old), which are not recycled and I haven't been able to vacuum them:
$ journalctl --list-boots --no-pager
-16 53baf678f0d749d6b390afea4a3ef96b Wed 2014-04-...
- 313