Linux 101 : Troubleshooting the system - the journalctl command -
To be able to monitor a system or troubleshoot it, we would need to know about the actions that were performed before.
To be able to see the messages coming from the kernel or from the services running on a system, we use the journalctl command for the systems that are using systemd.
Remark:
For the systems that don't rely on systemd for running their services, we could use the more traditional rsyslogd or syslogd.
Systemd relies on journalctl to get information about the different elements of the system that sytemd manages.
For example the boot's error messages and other messages are sent to and get managed by the systemd-journald.service service.
We could access those messages using the journalctl command.
For example using the journalctl command without any arguments, we could display all the messages, from the kernel, user services, system services, ... - unfiltered -.
We could filter those messages by using different arguments like the below example that lists the different boots we have performed assigning an ID to each boot.
We could then use that boot ID to display all the kernel messages regarding that specific boot, for example :
We could also filter the output of journalctl to only see the kernel messages using the below command:
The below example shows only the messages that are coming from system services:
To see the messages regarding a specific service - service_name -, we could use the below command:
To be able to see the messages coming from user services, we use the below command:
To watch the messages of systemd "live", we use the below command:
Messages from systemd journaling have a number attached to them that tells us how critical the message is. This priority goes from "0" to "7".
We could display the messages by priority using the below command:
Below are the different priorities used for the messages depending on their importance:
- 0 : emergency.
- 1 : alert.
- 2 : critical.
- 3 : error.
- 4 : warning.
- 5 : notice.
- 6 : info.
- 7 : debug.
Comments