Hello and welcome to this video on Oracle Linux 8.
In this video, I will cover Oracle Linux 8's journald service using the journalctl
command utility.
Jounrald is a logging system included with systemd.
Journald stores data in structured, indexed journals that support advanced query
options and faster search times than traditional log files.
Journald adds structured metadata to the messages that assist in troubleshooting.
Journald can be used together with, or in place of, rsyslogd.
By default, the journal stores log data in /run/log/journal.
To view journal logs, use the journalctl comamnd.
By default, the listed entries include a timestamp, hostname,
the application involved, and the given message.
After watching this video, you'll learn to:
Describe the journald logging service.
Explain how to use the journalctl command and associated options.
Describe how to view log entries with specific priorities such debug, info, and warning.
And finally, you will be able to explain how to view metatdata for log entries.
Let's now explore the journald serivce with journalctl.
As root, use the journalctl command to query the systemd journal by running
journalctl with no options or arguments.
Note the following that all log data is displayed, including rotated logs.
Also, entries with notice and warning priority are in bold font.
Next, run the journalctl -h command to display usage and query options
To display the newest log entries first run the journalctl -r command.
To display the three newest log entries run the
journalctl –n 3 command.
Using the –n option displays a specific number of the most recent
log entries.
Now run the journalctl –p debug command to display log entries with a priority of
debug.
You can use the -p option to display log entries of any priority.
To view log entries with the priority of info run journalctl command with the -p info option:
Now view log entries with the priority of warning run journalctl command with the -p
warning option:
You can run the journalctl –u crond command to display log entries associated with
the crond unit.
Using the -u option displays log entries for any systemd unit.
As mentioned before, journald adds structured metadata to log messages, which assists in
troubleshooting.
Type the journalctl command, add a space, and then press the Tab key twice to
display the metadata fields.
After displaying the metadata fields, type CTRL + C to terminate the command.
Now run the journalctl –o verbose command to display log entries in verbose format.
Verbose format shows the metadata fields and values for all journal entries.
You can use the -o option to display log entries in any supported format such as
short, json, and cat to name just a few.
Finally, run the journalctl -F _UID command to display unique values for the _UID
metadata field.
Run the journalctl _UID=1000 command to show only log entries that match 1000.
Oracle provides an extensive number of resources which you can use to learn more
about this subject and others.
Look for additional videos on Oracle Linux 8 and other topics using the links shown.
This concludes the video.
Thank you for watching.