When you are doing system administrations, you often deal with daemon type of applications. When things are not going so well, you can check log files under /var/log but you can also use journalctl to “query the systemd journal”.
journalctl -e lets you view the latest log instead of showing all logs from the beginning.
$ sudo journalctl -e
If you add -x to the option, you get view more detailed information.
$ sudo journalctl -xe
Nov 18 01:10:15 ol8 systemd[18878]: Reached target Default. -- Subject: Unit UNIT has finished start-up -- Defined-By: systemd -- Support: https://access.redhat.com/support -- -- Unit UNIT has finished starting up. -- -- The start-up result is RESULT. Nov 18 01:10:15 ol8 systemd[18878]: Startup finished in 79ms. -- Subject: User manager start-up is now complete -- Defined-By: systemd -- Support: https://access.redhat.com/support -- -- The user manager instance for user 0 has been started. All services queued -- for starting have been started. Note that other services might still be starting -- up or be started at any later time. -- -- Startup of the manager took 79574 microseconds. Nov 18 01:10:15 ol8 systemd[1]: Started User Manager for UID 0. -- Subject: Unit user@0.service has finished start-up -- Defined-By: systemd -- Support: https://access.redhat.com/support -- -- Unit user@0.service has finished starting up. -- -- The start-up result is RESULT. Nov 18 01:10:15 ol8 sshd[18872]: pam_unix(sshd:session): session opened for user root by (u> Nov 18 01:17:01 ol8 sssd[kcm][18823]: Shutting down Nov 18 01:21:40 ol8 adcli[18929]: GSSAPI client step 1 Nov 18 01:21:40 ol8 adcli[18929]: GSSAPI client step 1 Nov 18 01:21:40 ol8 adcli[18929]: GSSAPI client step 1 Nov 18 01:21:40 ol8 adcli[18929]: GSSAPI client step 2
-f option allows you to monitor the log just like tail -f option.
$ sudo journalctl -f
If you want to view a particular daemon, you can specify the name of it.
$ sudo journalctl -e -u sshd
It’s really good to know some basic options to use with journalctl.
