Tuesday, January 17, 2017

Debugging system log files

Generally the logs are located at /var/log.

With systemd there is a tool called journald (built-in demon).

#journalctl   =>
will dump all the information in journal demon.

Journal is not persistent and is removed at reboot.

All the information is present in /run/log/journal/

To make the journal persistent. Uncomment the below line





After making the journal persistent. The information is stored at /var/log/journal.






Monitor the journal.

#journalctl –f  => return last 10 lines of journal.



/etc/rsyslog.conf    => This is a configuration file which says where should the logs sent to.

example:  authpriv* 
à /etc/log/security


/var/log/systemd.analyze
à return time taken at boot.


/var/log/systemd.analyze blame
à return all units and time taken by each unit while boot.





No comments:

Post a Comment