{{tag>SystemD}}

= Systemd journalctl journal logs

Voir https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-systemd-logs


== Requête sur les logs, chercher et trouver 

Trouver les logs entres deux dates

Voir [[find_entre_deux_dates]]

<code bash>
journalctl --since "2016-10-18 06:50" --until "2016-10-18 09:00"
journalctl --since yesterday -p err
</code>

Par service et/ou par PID
<code bash>
journalctl -u pacemaker.service --since "2017-02-24 16:00" -p warning
journalctl _SYSTEMD_UNIT=avahi-daemon.service _PID=28097 + _SYSTEMD_UNIT=dbus.service
</code>

Voir aussi
<code bash>
ps -f -p 28097
systemctl status 28097

# Par PPID
ps -f --ppid 1
</code>



Erreur au boot
<code bash>
journalctl -b -p err
</code>

tailf
<code bash>
# dmesg -l warn
journalctl -f -p warning
</code>

Ouvrir un fichier spécifique
<code bash>
journalctl --file /tmp/plop.journal
</code>

Filtrer les logs json
<code bash>
journalctl -u nginx -o json-pretty  |jq '. |select(.SYSLOG_IDENTIFIER=="plop")
</code>

Les commandes sudo
<code ->
# journalctl -b -t sudo -p 5 -u session-*.scope
Sep 12 08:19:01 vmdeb01 sudo[601]:    admin : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/bin/bash
</code>



=== Options sur le forme

Arguments :
* ''--no-pager''
* ''-f'' : tail -f

== Configuration



=== Rendre persistant journalctl

Source : https://geekeries.de-labrusse.fr/?p=3189

Par défaut journalctl affiche uniquement les logs du dernier boot

<code ->
# journalctl --boot=-1
Failed to look up boot -1: Cannot assign requested address
</code>

Pour avoir les logs persistant :


''/etc/systemd/journald.conf''
<code ini>
[Journal]
#Storage=auto
Storage=persistent
Compress=yes

#SystemMaxUse=
SystemMaxUse=250M

#ForwardToSyslog=yes
</code>

<code bash>
mkdir /var/log/journal
systemd-tmpfiles --create --prefix /var/log/journal
systemctl restart systemd-journald
</code>


== Journalctl et container

Source : https://docs.docker.com/engine/logging/drivers/journald/

|CONTAINER_ID      |	The container ID truncated to 12 characters.                                 |
|CONTAINER_ID_FULL |	The full 64-character container ID.                                          |
|CONTAINER_NAME	   | The container name at the time it was started. If you use docker rename to rename a container, the new name isn't reflected in the journal entries.                                                 |
|CONTAINER_TAG,\\ SYSLOG_IDENTIFIER|	The container tag ( log tag option documentation).           |
|CONTAINER_PARTIAL_MESSAGE |	A field that flags log integrity. Improve logging of long log lines. |
|IMAGE_NAME         |	The name of the container image.                                             |


=== Retrieve log messages with journalctl

Use the journalctl command to retrieve log messages. You can apply filter expressions to limit the retrieved messages to those associated with a specific container:

<code bash>
sudo journalctl CONTAINER_NAME=webserver
</code>

You can use additional filters to further limit the messages retrieved. The ''-b'' flag only retrieves messages generated since the last system boot:

<code bash>
sudo journalctl -b CONTAINER_NAME=webserver
</code>

The -o flag specifies the format for the retrieved log messages. Use ''-o json'' to return the log messages in JSON format.

<code bash>
sudo journalctl -o json CONTAINER_NAME=webserver
</code>


View logs for a container with a TTY enabled

If TTY is enabled on a container you may see [10B blob data] in the output when retrieving log messages. The reason for that is that \r is appended to the end of the line and journalctl doesn't strip it automatically unless ''--all'' is set:

<code bash>
sudo journalctl -b CONTAINER_NAME=webserver --all
</code>


==== Journalctl container et Python

Retrieve log messages with the journal API
This example uses the systemd Python module to retrieve container logs:

<code python>
import systemd.journal

reader = systemd.journal.Reader()
reader.add_match('CONTAINER_NAME=web')

for msg in reader:
    print '{CONTAINER_ID_FULL}: {MESSAGE}'.format(**msg)
</code>


=== Autres

''/etc/systemd/journald.conf''
<code ini>
[Journal]
RateLimitInterval=10s
RateLimitBurst=6000
</code>


== Pb

=== Pb plus de logs avec journalctl ni dans /var/log/message

''/var/log/message'' vide ?
<code ->
# journalctl                                                                                                                                                                                                    
No journal files were found.                                                                     
-- No entries --
</code>


Solution
<code bash>
systemctl restart systemd-journald
systemctl restart rsyslog.service
</code>