journalctl for systemd logs in Linux CLI - Mini Project: Build & Apply

Using journalctl to View systemd Logs

📖 Scenario: You are a system administrator who needs to check system logs to troubleshoot issues on a Linux server that uses systemd. You will learn how to use the journalctl command to view logs efficiently.

🎯 Goal: Build a simple script that uses journalctl commands to filter and display systemd logs based on time and priority.

📋 What You'll Learn

Use journalctl to view logs

Filter logs by time range

Filter logs by priority level

Display the filtered logs

💡 Why This Matters

🌍 Real World

System administrators often need to check system logs to find errors or warnings. Using journalctl with filters helps quickly find relevant logs.

💼 Career

Knowing how to use journalctl is essential for Linux system administrators and DevOps engineers to troubleshoot and maintain servers.

1

Create a variable with the systemd log file path

Create a variable called log_file and set it to /var/log/journal which is the default directory for systemd logs.

Linux CLI

log_file = ''
# Your code here

Need a hint?

The systemd journal logs are stored in /var/log/journal by default.

2

Set a time filter for logs

Create a variable called time_filter and set it to --since "2024-01-01 00:00:00" to filter logs from January 1, 2024 onwards.

Linux CLI

log_file = '/var/log/journal'
time_filter = ''
# Your code here

Need a hint?

The --since option in journalctl filters logs starting from a specific date and time.

3

Add a priority filter for error logs

Create a variable called priority_filter and set it to --priority=err to filter only error level logs.

Linux CLI

log_file = '/var/log/journal'
time_filter = '--since "2024-01-01 00:00:00"'
priority_filter = ''
# Your code here

Need a hint?

The --priority option filters logs by severity. err means error level logs.

4

Display filtered logs using journalctl

Use the print function to display the command journalctl {time_filter} {priority_filter} as a string, showing the full command that filters logs by time and priority.

Linux CLI

log_file = '/var/log/journal'
time_filter = '--since "2024-01-01 00:00:00"'
priority_filter = '--priority=err'
# Your code here

Need a hint?

Use an f-string to combine the filters into the journalctl command string.