systemd Journal and System Logs
One objective and the most useful troubleshooting skill in the blueprint. The journal is structured rather than textual, which is why it can be filtered by unit, priority, boot and arbitrary field - and why grep on /var/log is the slow way to do this.
Operating Running Systems Guide 28 of 67 Beginner
- OSRHEL 10.0
- Kernel6.12.0-55.9.1.el10_0
- dnf4.20.0
- Flatpak1.16.0
- TimeAbout 13 min
The journal is a binary, indexed store; journalctl is the only way to read it. rsyslog still writes plain-text files alongside it - /var/log/secure, /var/log/messages - so both exist on a RHEL system and neither replaces the other.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| RHCSA-A01 | 192.168.0.31 | RHEL 10.0 | Practice node (graded) - spare /dev/sda | 2 Core | 4 GB | 50 GB + 15 GB |
This guide includes
Use this because it is the most useful troubleshooting skill in the blueprint. This matters because the journal is structured data rather than text - so filtering is the whole point, and the old text files still exist alongside it.
- filtering the journal, which is the entire point of it
- seeing that it is structured rather than plain text
- finding the text log files that still exist
Before you start
- A sudo-capable account.
- Everything here is read-only.
-
Filtering, which is the whole point
-
It is structured, not text
-
The text files that still exist