Bookmark this page

Guided Exercise: Finding Events With journalctl

In this lab, you will filter the systemd journal for specific criteria.

Outcomes

Students will practice displaying the systemd journal output matching different criteria.

  1. Output only systemd journal messages that originate from the systemd process that always runs with process id 1 on serverX.

    [root@serverX ~]# journalctl _PID=1
  2. Display all systemd journal messages that originate from a system service started with user id 81 on serverX.

    [root@serverX ~]# journalctl _UID=81
  3. Output the journal messages with priority warning and above on serverX.

    [root@serverX ~]# journalctl -p warning
  4. Create a journalctl query to show all log events recorded in the previous 10 minutes on serverX. The command assumes a current time of 9:15:00.

    [root@serverX ~]# journalctl --since 9:05:00 --until 9:15:00
  5. Display only the events originating from the sshd service with the system unit file sshd.service recorded since 9:00:00 this morning on serverX.

    [root@serverX ~]# journalctl --since 9:00:00 _SYSTEMD_UNIT="sshd.service"
Revision: rh124-7-1b00421