IT-230

Linux Administration

Exercise

Reading the Journal Exercise

Task

Find journal entries by unit and by time, then make the journal survive a reboot so you can read what happened before a crash.

Host
servera
Reboots
one, in step 5

  1. Read the journal for one service

    -u limits the journal to a single unit. It opens in less, oldest first. 

    journalctl -u sshd.service

    Press G to jump to the newest entries and q to quit.

  2. Narrow it to a time window

    journalctl --since "30 minutes ago"

    Press q, then combine both filters to ask a precise question. 

    journalctl -u sshd.service --since "30 minutes ago" --no-pager

  3. See how many boots are recorded

    journalctl --list-boots
ls -d /run/log/journal
ls -d /var/log/journal

  4. Make the journal persistent

    Creating the directory is the whole configuration. journald notices and switches to it. 

    sudo mkdir /var/log/journal
sudo journalctl --flush
ls -d /var/log/journal

  5. Reboot and read the previous boot

    sudo reboot

    Wait for servera to come back, reconnect, and look again. 

    ssh servera
journalctl --list-boots
journalctl -b -1 --no-pager

  6. Clean up

    Remove the directory to send journald back to memory-only storage. 

    sudo rm -rf /var/log/journal
sudo systemctl restart systemd-journald
journalctl --list-boots