Show Menu
Cheatography
  1. Home >
  2. Software >

Syslogd & Journal Cheat Sheet (DRAFT) by

Syslogd & Journal for RHCSA EX200

This is a draft cheat sheet. It is a work in progress and is not finished yet.

Commands

journalctl
Shows more detailed inform­ation from the journal.
tail -f <lo­gfi­le>
Shows in real time which lines are added to the log file.
systemctl status <un­it>
Show a short overview of the last signif­icant events that have been logged by Systemd units through journald.
logger
Enables users to write messages to rsyslog from the command line or a script
journalctl --since [--until]
to show all messages that have been written since given date (and up to, if provided)

Defini­tions

Facility
Specifies a category of inform­ation that is logged. rsyslogd uses a fixed list of facili­ties, which cannot be extended. This is because of backward compat­ibility with the legacy syslog service.
Priority
Used to define the severity of the message that needs to be logged. When you specify a priority, by default all messages with that priority and all higher priorities are logged. This is a fixed list.
Destin­ation
Defines where the message should be written. Typical destin­ations are files, but rsyslog modules can be used as a destin­ation as well, to allow further processing through a rsyslogd module.
local0 through local7
If services that do not have their own rsyslogd facility need to write log messages to a specific log file anyway, these services can be config­ured.
/run
This directory is used for current process status inform­ation only, which means that the journal is cleared when the system reboots.
 

journald

journald
provides an advanced log management system. journald collects messages from the kernel, the entire boot procedure, and services and writes these messages to an event journal.
Implem­ented:
which is implem­ented by the system­d-j­ournald daemon
Format:
Binary
Retention:
Non-pe­rsi­stent; however, forwarded to rsyslogd

Tips & Config­uration

Logger
Services and users can write directly to log files themselves or through rsyslogd.
/etc/r­sys­log.conf
You can configure the rsyslogd service through here.
/etc/s­ysc­onf­ig/­rsyslog
If specific options need to be passed to the rsyslogd service on startup, you can do this by using this file.
(-) Buffered logging
Begin destin­ations with hyphens caused to have the log messages will not be immedi­ately committed to the file but instead will be buffered to make writes more efficient.
/etc/l­ogr­ota­te.conf
The default settings for log rotation are kept in here.
/etc/l­ogr­otate.d
Specific logging config­ura­tions are placed here and override default config­ura­tions.
/var/l­og/­journal
Create to make the journal persistent between system restarts.
/etc/s­yst­emd­/jo­urn­al.conf
Storing the journal perman­ently requires setting the Storag­e=auto parameter.