Index

systemd journal

config files
/etc/systemd/journald.conf
/etc/systemd/journald.conf.d/*.conf
/run/systemd/journald.conf.d/*.conf
/usr/lib/systemd/journald.conf.d/*.conf
view entire journal
journalctl
view journal entries for service
journalctl -u docker
view journal since last boot
journalctl -b
view journal in last day
journalctl  --since='yesterday'
view error messages
journalctl -p err
tail journal
journalctl -f
view total disk space used
journalctl --disk-usage
clean up old log files (by maximum disk usage)
journalctl --vacuum-size=100M
clean up old log files by time
journalctl --vacuum-time=2weeks
example settings
SystemMaxUse=50M    # max size per file 50MB
SystemMaxFiles=5    # keep a maximum of 5 files
MaxFileSec=1month   # delete log files older than a month
documentation
man journald.conf
https://www.freedesktop.org/software/systemd/man/journald.conf.html
https://wiki.archlinux.org/index.php/Systemd/Journal

system log

view syslog
vi /var/syslog
write to syslog
logger “Hello World”

logrotate

config files
/etc/logrotate.conf
/etc/logrotate.d/*
rotate time based
daily
weekly
monthly
yearly
rotate based on file size (useable with time based rotation)
maxsize 100M
rotate based on file size (mutually exclusive with time based rotation)
size 100M
do not compress the first rotation .1
delaycompress
call manually
logrotate -v /etc/logrotate.conf  | less
call manually and force rotate (even if files not ready for rotation yet)
logrotate -f -v /etc/logrotate.conf  | less

man logrotate
https://linux.die.net/man/8/logrotate