Managing Logs¶
- lastlog
- last, lastb
- dmsg
- syslog, logger, logrotate
- journalctl
lastlog¶
In [29]:
lastlog -u milad
In [47]:
lastlog | tail -3
In [48]:
lastlog | grep -vi never
last, lastb¶
In [37]:
# last --help
last --since "5 min ago" -n 1
In [78]:
last | tail -6 | tac | tail -4
In [40]:
last reboot -n5
In [ ]:
sudo lastb
milad tty1 Fri Feb 24 12:26 - 12:26 (00:00)
In [43]:
ls /var/log/*tmp -1
dmesg¶
- dmesg obtains its data by reading the kernel ring buffer.
- buffer is a portion of a computer's memory that is set aside as a temporary holding place for data that is being sent to or received from an external device, such as a hard disk drive (HDD), printer or keyboard.
- ring buffer is a buffer of fixed size for which any new data added to it overwrites the oldest data in it.
In [5]:
whatis dmesg
In [1]:
dmesg -l err -H # Level, Human readable
In [7]:
cat /var/log/dmesg # Until system boot
SYSLOG, Logger, logrotate¶
In [22]:
pgrep syslog -a
In [43]:
# Lets see what syslog is
apt-cache show rsyslog | grep -i desc -A14 -m1 | cat
In [54]:
ls /var/log | egrep -v "gz|.1" | tr "\n" " "
apt auth.log btmp dmesg kern.log lastlog wtmp syslog
In [55]:
tail /var/log/auth.log | grep sudo | head -1
In [2]:
# lets see how rsyslog manages these files
# facilities 0.kern
# priority 0 emerg
# /identifier sudo/
vim /etc/rsyslog.d/50-default.conf
In [71]:
logger -p mail.err "Milad is not able to send mail"
In [14]:
tail -1 /var/log/mail.err
In [79]:
whatis logrotate
In [ ]:
logrotate /etc/logrotate.conf
In [ ]:
/var/log/test.log
{
rotate 4
weekly
missingok
notifempty
compress
}
journalctl¶
When used alone, every journal entry that is in the system will be displayed.
- Includes logs from:
- the early boot process
- the kernel
- the initrd
- applications stdout/stderr
In [6]:
whatis journalctl
In [17]:
# remember our mail message log?
# logger -p mail.err "Milad is not able to send mail"
journalctl SYSLOG_FACILITY=2 -n1
In [8]:
journalctl -n 3
In [11]:
journalctl -n 2 -x # extra explaination (catalog)
Persistent Log¶
In [ ]:
# vim /etc/systemd/journald.conf
[Journal]
Storage=persistent
In [ ]:
man 5 journald.conf
/Storage
"volatile", "persistent", "auto"
"persistent", data will be stored preferably on disk
Filter by boot or time¶
In [7]:
journalctl --list-boots
In [11]:
journalctl -b # Last boot
In [80]:
journalctl -b 8dcd6ce7c4f141eb9c52dd88b71ac0d6 -n1
# journalctl -b 0
In [18]:
journalctl --since 16:02 --until 16:07
In [17]:
journalctl --since "2017-02-28 16:05"
Available words: "yesterday", "today", "tomorrow", or "now"
In [ ]:
journalctl --since yesterday
In [ ]:
journalctl --since 01:00 --until "5 hour ago"
Filter by units¶
In [88]:
journalctl -u virtualbox.service -n1
In [89]:
journalctl _SYSTEMD_UNIT=virtualbox.service --no-full -n1
In [18]:
systemctl status dbus
In [19]:
journalctl -u dbus -n --no-full
In [24]:
journalctl -u dbus.service --since yesterday -n3 -b0
In [42]:
journalctl -t dbus -n3 --no-full # syslog identifier (look at systemd message at above example)
Filter by fileds¶
man systemd.journal-fields
In [33]:
journalctl -N | grep "^_" | tail -10
In [26]:
journalctl _UID=`id -u privoxy`
Available values for a given journal field:
In [40]:
journalctl -F _TRANSPORT
# transport = How the entry was received by the journal service.
In [32]:
journalctl _TRANSPORT=kernel | head -3 | tail -2
In [30]:
journalctl -F SYSLOG_IDENTIFIER -n10
In [39]:
journalctl -t smartd -r -n1
SYSLOG Facilities¶
- syslog facilities:
- 0 kernel messages
- 1 user-level messages
- 2 mail system
- 3 system daemons
- 4 security/authorization messages
- 5 messages generated internally by syslogd
- 6 line printer subsystem
- 7 network news subsystem
- 8 UUCP subsystem
- 9 clock daemon
- 10 security/authorization messages
- 11 FTP daemon
- 12 NTP subsystem
In [1]:
journalctl -N | grep -i fac
In [3]:
journalctl -F SYSLOG_FACILITY | tr '\n' ' '
Kernel logs¶
kernel ring buffer (dmesg)
In [35]:
journalctl -k | wc -l
journalctl --dmesg | wc -l
dmesg | wc -l
In [36]:
journalctl -k -b -3
In [9]:
journalctl SYSLOG_FACILITY=0 -n2
Logs generated by a binary¶
In [55]:
journalctl `which NetworkManager` -n1
In [39]:
journalctl -u NetworkManager.service | wc -l
journalctl `which NetworkManager` | wc -l
Priority¶
journalctl -p [tab][tab]
0: emerg : System is unusable
1: alert : Should be corrected immediately
2: crit : Critical conditions
3: err : Error conditions
4: warning : May indicate that an error will occur if action is not taken.
5: notice : Events that are unusual, but not error conditions.
6: info : Normal operational messages that require no action.
7: debug : Information useful to developers for debugging the application. In [5]:
journalctl -p 1 -n1 # -p emerg
In [ ]:
journalctl -p crit -o json-pretty # [tab-tab]
In [ ]:
journalctl -k -f # following like tail -f
Old logs¶
In [94]:
journalctl --disk-usage
sudo journalctl --vacuum-size=5M
sudo journalctl --vacuum-time=2months
In [ ]:
Referenses:
LFCS & RHCSA
man dmsg
man journalctl
man 5 journald.conf
man systemd.journal-fields
http://www.linfo.org/dmesg.html
https://wiki.archlinux.org/index.php/Systemd
https://help.ubuntu.com/community/LinuxLogFiles
https://tools.ietf.org/html/rfc5424#section-6.2.1
https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-systemd-logs
Lecture notes¶
- All lecture notes are available at github in
ipynbformat: https://github.com/ravexina/linux-notes.
- There are
htmlexports of project available at: https://ravexina.github.io/linux-notes.
License¶
Linux Notes by Milad As (Ravexina) is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
