Join Chaim Krause for an in-depth discussion in this video System logging, part of SUSE Linux Enterprise Server Essential Training.
- (Voiceover) When it comes to logging there's been a change to series Linux enterprise 12. It introduced it's on logging system called Journal. Everything going forward is suppose to be using this system compared to Syslog. Although I will show you ways to connect the two together. We're gonna concentrate on Journal. Journal itself, managed by System D like the other services. Let's use system control and status to check the status of our Journal system.
It's system D, journal D. And we can see that it's uploaded, active running. So there is a companion for the damen. And that is journal control. So if you type journalctl and hit enter. What you're going to get is you're going to get the top of the journal from the beginning. And then you can use the space bar to go through.
And you'll see all of the logging there. I'm gonna hit Q to exit here. If you want to get the current stuff first then what you can use is dash R for reverse order. And you will get the most current stuff at the top. We'll quit here and I'm going to use journal again. And this time I'm going to use dash E. It jumps to the end.
So it's in the same order as when you simple use journalctl. Except it automatically jumps to the end for you. Let's look at another. If you use a dash X, what you will get is you will also get comments within the log. So here's a section in the journal where we have comments. You can see where they're providing you information or you can find support which is very helpful.
Let's clear the screen so we can take a look at another choice here. And that is if we use journalctl and we say dash dash list boots. And we will see all of the boot operations that have been journaled. So if I were to reboot this machine two or three more times then we would have a zero, a one, a two, a three, et cetera. It's an easy way to find out how the journal has jumped.
Let's clear the screen and you can also do some filtering on times. So let's say I use journalctl. I can use dash dash since today, which will get it starting at midnight. And so this is the log starting at midnight today. So we can also use until and I can say six a.m.
And now it will start at midnight and if I jump through all of these we will end at six a.m. Let's clear our screen. If I take a look at what processes are currently running, then I can get some ID's. So for example, if I take ID 113879. Then I can check the journal just for that by using journal control underscore PID equals the PID I'm interested in.
And if there's anything in the log that pertains to that particular process it will filter upon that. Let's clear our screen. And what I'm going to do is bring up the man page. And then I'm going to hit slash and type in dash dash out, so we can skip to the option. Which is either dash O for the short option or dash dash output for the long option. And this will change how the output is formatted.
So one of the things you may you want to turn on when debugging is verbose, to get the full structured entry. As you can we got json and json pretty, which are formats you might want to use if you are exporting the data to be used in some other program. And let's quit here and clear our screen. You can also look at the journal through yast. But what is needed is not installed by default. So we're going to use zipper and we are going to install the package yast two journal.
Yes we want to install. Now if we want to open up yast, and we look under system. On the far right side we see now an entry for system D journal. If we open that up we can now look at our journal through yast. You can filter by entering in text in the search line and you can also change what's filtered by default. And you can click on the button in the bottom left.
Change filter to change those conditions. So we can say, since boot. And I want to say system D units. Let's see if we've got anything for HDTPD. So we don't have any hits for that. Let's try looking for the journaling itself. And there we've got several hits. So you can filter that any way you like. And it's a little bit easier to use than the command line.
One last thing I'd like to show you if we go back to our terminal. Is that if you want to interact with Syslog, you can go into the file, etc system D journal D dot com. And if you open that up you look for forward to Syslog. And you simply change that to read yes without the comment. And then that will forward everything to Syslog so you can also use your traditional Syslog tools.
And that's it for journaling.
- What is SUSE Linux Enterprise?
- Installing SLES
- Linux file types
- Working at the command line
- Managing processes
- Working with background processes
- Managing users and groups
- Changing file permissions
- Configuring network interfaces
- Displaying hardware information
- Managing drivers