Logging#

Rsyslogd#

# echo "*.debug /var/log/messages-debug" > /etc/rsyslog.d/debug.conf
$ logger -p user.debug "Dit is een debug test"

Journald#

$ journalctl
$ journalctl -n 10
$ journalctl -p err
$ journalctl -f
$ journalctl --since yesterday
$ journalctl --since "2021-12-06 13:00:00" --until yesterday
$ journalctl -o verbose
$ journalctl _SYSTEMD_UNIT=sshd.service _PID=28203
-- Logs begin at Mon 2021-12-06 10:28:15 CEST, end at Mon 2021-12-06 12:32:05 CEST. --
Dec 06 10:25:32 server01.intranet sshd[28203]: Accepted password for user01 from 213.19.196.11 port 34590 ssh2

Persistant journal#

# mkdir -p /var/log/journal
# chown root:systemd-journal /var/log/journal
# chmod 2775 /var/log/journal
# killall -USR1 systemd-journald
# journalctl -b
# journalctl -b 1