Table of contents
systemd journal
config files
/etc/systemd/journald.conf
/etc/systemd/journald.conf.d/*.conf
/run/systemd/journald.conf.d/*.conf
/usr/lib/systemd/journald.conf.d/*.conf
example settings
SystemMaxUse=50M # max size per file 50MB
SystemMaxFiles=5 # keep a maximum of 5 files
MaxFileSec=1month # delete log files older than a month
journalctl
view entire journal
journalctl
view all fields (in full)
journalctl -a
view journal entries for service
journalctl -u docker
view journal since last boot
journalctl -b
view journal in last day
journalctl --since='yesterday'
view error messages
journalctl -p err
tail journal
journalctl -f
show reboots logged in journal
journalctl --list-boots
view total disk space used by journal files
journalctl --disk-usage
clean up old log files (by maximum disk usage)
journalctl --vacuum-size=100M
clean up old log files by time
journalctl --vacuum-time=2weeks
documentation
man journald.conf
https://www.freedesktop.org/software/systemd/man/journald.conf.html
https://wiki.archlinux.org/index.php/Systemd/Journal
system log
view syslog
vi /var/syslog
write to syslog
logger “Hello World”
logrotate
config files
/etc/logrotate.conf
/etc/logrotate.d/*
rotate time based
daily
weekly
monthly
yearly
rotate based on file size (useable with time based rotation)
maxsize 100M
rotate based on file size (mutually exclusive with time based rotation)
size 100M
do not compress the first rotation .1
delaycompress
call manually
logrotate -v /etc/logrotate.conf | less
call manually and force rotate (even if files not ready for rotation yet)
logrotate -f -v /etc/logrotate.conf | less
man logrotate
https://linux.die.net/man/8/logrotate