Intermediate LevelLinux Commands & SysAdmin
How do you inspect systemd logs using journalctl (journalctl -u myapp -f --since "1 hour ago")?
❓ Interview Prompt: Explain journalctl binary log viewer, unit filtering (-u), follow live stream (-f), time bounds (--since), priority (-p err), and vacuuming log size.
'journalctl' queries binary logs collected by the 'systemd-journald' logging daemon:
Essential Options:
•
'-u myapp.service': Filter logs for specific service unit.
•
'-f': Follow live log stream (like 'tail -f').
•
'--since "2 hours ago"' / '--until "10 minutes ago"': Time range bounds.
•
'-p err': Filter by priority level (emerg, alert, crit, err, warning).
•
'--vacuum-size=1G': Purge old journal logs to free disk space.
Code Implementation Example
bash
# Follow live logs for specific systemd service
journalctl -u nginx.service -f
# Inspect error logs from last 30 minutes
journalctl -u node-app.service -p err --since "30 min ago"
# Check journal disk usage and vacuum to 500MB
journalctl --disk-usage
sudo journalctl --vacuum-size=500M💡Filtering and following systemd service logs using journalctl.
🎯 Interview Key Takeaway
Use journalctl -u service -f to stream live service logs, and journalctl -p err --since to debug errors within specific time windows.
#journalctl#systemd-journald#Logging#Intermediate
Back to all Linux Commands & SysAdmin Questions→