Pages

Tuesday, March 28, 2017

The journalctl command.

This is a good Linux command for Linux maintenance.
The first step is to read the documentation:
[root@localhost mythcat]# man journalctl
JOURNALCTL(1)                     journalctl                     JOURNALCTL(1)

NAME
       journalctl - Query the systemd journal

SYNOPSIS
       journalctl [OPTIONS...] [MATCHES...]

DESCRIPTION
       journalctl may be used to query the contents of the systemd(1) journal
       as written by systemd-journald.service(8).

       If called without parameters, it will show the full contents of the
       journal, starting with the oldest entry collected.

       If one or more match arguments are passed, the output is filtered
       accordingly. A match is in the format "FIELD=VALUE", e.g.
       "_SYSTEMD_UNIT=httpd.service", referring to the components of a
       structured journal entry. See systemd.journal-fields(7) for a list of
       well-known fields. If multiple matches are specified matching different
       fields, the log entries are filtered by both, i.e. the resulting output
       will show only entries matching all the specified matches of this kind.
       If two matches apply to the same field, then they are automatically
       matched as alternatives, i.e. the resulting output will show entries
       matching any of the specified matches for the same field. Finally, the
       character "+" may appear as a separate word between other terms on the
       command line. This causes all matches before and after to be combined
       in a disjunction (i.e. logical OR).
       ...
The self-maintenance method is to vacuum the logs.
This helps you with free space into your Linux OS.
For example, I got 3 Gigabytes of data in just 3 days.
# journalctl --vacuum-time=3d
Vacuuming done, freed 3.7G of archived journals on disk. To clean up this you can use the command into several ways:
  • by time
  • journalctl --vacuum-time=2d
  • retain only the past 500 MB
  • journalctl --vacuum-size=500M
As you know: The is an init system used in Linux distributions to bootstrap the user space and manage all processes subsequently. The journald daemon handles all of the messages produced by the kernel, initrd, services, etc. You can use the journalctl utility, which can be used to access and manipulate the data held within the journal. Let's start with some examples: How to see the configuration file for this process:
[root@localhost mythcat]# cat /etc/systemd/journald.conf
Also, you can see the status of this service:
[root@localhost mythcat]# systemctl status  systemd-journald
● systemd-journald.service - Journal Service
   Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static; vendor preset: disabled)
   Active: active (running) since Tue 2017-03-28 09:12:20 EEST; 1h 8min ago
     Docs: man:systemd-journald.service(8)
           man:journald.conf(5)
 Main PID: 803 (systemd-journal)
   Status: "Processing requests..."
    Tasks: 1 (limit: 4915)
   CGroup: /system.slice/systemd-journald.service
           └─803 /usr/lib/systemd/systemd-journald

Mar 28 09:12:20 localhost.localdomain systemd-journald[803]: Runtime journal (/run/log/journal/) is 8.0M,
max 371.5M, 363.5M free.
Mar 28 09:12:20 localhost.localdomain systemd-journald[803]: Journal started
Mar 28 09:12:22 localhost.localdomain systemd-journald[803]: System journal (/var/log/journal/) is 3.9G,
max 4.0G, 23.8M free.
Mar 28 09:12:23 localhost.localdomain systemd-journald[803]: Time spent on flushing to /var is 915.454ms
I hope this article will help you with Linux maintenance