Linux Cheatsheet 08 — Logs and journald

journalctl                          # all logs
journalctl -f                       # follow
journalctl -n 100                   # last 100
journalctl --since "10 min ago"
journalctl --since "yesterday"
journalctl --since "2026-01-15" --until "2026-01-16"
journalctl -p err                   # priority error+
journalctl -p warning..err          # range
journalctl -u nginx                 # unit
journalctl _PID=1234
journalctl _UID=1000
journalctl --boot                   # current boot
journalctl --boot -1                # previous boot
journalctl --list-boots
journalctl -k                       # kernel only
journalctl -o json                  # JSON output
journalctl -o short-iso             # ISO timestamps
journalctl --no-pager

journalctl --disk-usage
journalctl --vacuum-size=500M
journalctl --vacuum-time=7d
journalctl --rotate

SystemMaxUse=500M
MaxRetentionSec=1month
ForwardToSyslog=no
Storage=persistent

systemctl restart systemd-journald

/var/log/syslog or /var/log/messages
/var/log/auth.log
/var/log/kern.log
/var/log/dpkg.log
/var/log/apt/
/var/log/nginx/
/var/log/mysql/

tail -f /var/log/syslog
grep ERROR /var/log/syslog

/etc/rsyslog.conf
/etc/rsyslog.d/*.conf

*.info;mail.none;authpriv.none;cron.none  /var/log/messages
auth.*,authpriv.*  /var/log/auth.log

*.* @loghost.example.com:514
*.* @@loghost.example.com:514     # TCP

/etc/logrotate.conf
/etc/logrotate.d/*

/var/log/myapp/*.log {
    daily
    rotate 14
    compress
    delaycompress
    missingok
    notifempty
    create 0640 myapp myapp
    sharedscripts
    postrotate
        systemctl reload myapp
    endscript
}

logrotate -d /etc/logrotate.d/myapp     # dry run
logrotate -f /etc/logrotate.d/myapp     # force

dmesg
dmesg -T                            # human time
dmesg -w                            # follow
dmesg --level=err,warn
dmesg | grep -i usb

0 emerg
1 alert
2 crit
3 err
4 warning
5 notice
6 info
7 debug

logger "something happened"
logger -t myapp -p user.warning "warning event"
logger -f file                      # send file contents

ausearch -k login
auditctl -w /etc/passwd -p wa -k passwd_changes
aureport

journalctl -b                       # current boot
journalctl -b -1                    # previous
journalctl -b -p 3                  # only errors+

systemctl --failed
journalctl -p 3 -xb

exec > >(logger -t myscript) 2>&1
echo "running"

echo '{"level":"info","msg":"thing","ts":"2026-01-15T12:00:00Z"}' | logger -t myapp

$ModLoad imtcp
$InputTCPServerRun 514
*.* /var/log/remote/%HOSTNAME%/messages