Hands-on Lab·Red Hat Certified System Administrator
systemd Journal and System Logs
One objective and the most useful troubleshooting skill in the blueprint. The journal is structured rather than textual, which is why it can be filtered by unit, priority, boot and arbitrary field - and why `grep` on `/var/log` is the slow way to do this.
Operating Running Systems Guide 28 of 67 Beginner
- OSRHEL 10.0 (Coughlan)
- Kernel6.12.0-55.9.1.el10_0
- dnf4.20.0
- Flatpak1.16.0
- TimeAbout 13 min
- Reviewed23 August 2026
Written against the versions above. The journal is a binary, indexed store; `journalctl` is the only way to read it. `rsyslog` still writes plain-text files alongside it - `/var/log/secure`, `/var/log/messages` - so both exist on a RHEL system and neither replaces the other.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| RHCSA-A01 | 192.168.0.31 | RHEL 10.0 (Coughlan) | Practice node (graded) - spare /dev/sda | 2 Core | 4 GB | 50 GB + 15 GB |
Before you start
- A sudo-capable account.
- Everything here is read-only.
-
Filtering, which is the whole point
-
It is structured, not text
-
The text files that still exist