Table of contents

systemd journal

config files

/etc/systemd/journald.conf
/etc/systemd/journald.conf.d/*.conf
/run/systemd/journald.conf.d/*.conf
/usr/lib/systemd/journald.conf.d/*.conf

example settings

SystemMaxUse=50M    # max size per file 50MB
SystemMaxFiles=5    # keep a maximum of 5 files
MaxFileSec=1month   # delete log files older than a month

journalctl

view entire journal

journalctl

view all fields (in full)

journalctl -a

view journal entries for service

journalctl -u docker

view journal since last boot

journalctl -b

view journal in last day

journalctl  --since='yesterday'

view error messages

journalctl -p err

tail journal

journalctl -f

show reboots logged in journal

journalctl --list-boots

view total disk space used by journal files

journalctl --disk-usage

clean up old log files (by maximum disk usage)

journalctl --vacuum-size=100M

clean up old log files by time

journalctl --vacuum-time=2weeks

documentation

man journald.conf
https://www.freedesktop.org/software/systemd/man/journald.conf.html
https://wiki.archlinux.org/index.php/Systemd/Journal

system log

view syslog

vi /var/syslog

write to syslog

logger “Hello World”

logrotate

config files

/etc/logrotate.conf
/etc/logrotate.d/*

rotate time based

daily
weekly
monthly
yearly

rotate based on file size (useable with time based rotation)

maxsize 100M

rotate based on file size (mutually exclusive with time based rotation)

size 100M

do not compress the first rotation .1

delaycompress

call manually

logrotate -v /etc/logrotate.conf  | less

call manually and force rotate (even if files not ready for rotation yet)

logrotate -f -v /etc/logrotate.conf  | less

man logrotate
https://linux.die.net/man/8/logrotate