Fedora is a systemd-based OS and since the release of Fedora 20, syslog has been replaced with the Journal. The journal stores the same information as classic syslog and running the ‘journalctl’ command will output a perfect copy of the traditional syslog files from /var/log/ , but with improvements:
- Lines of error priority (and higher) will be highlighted red.
- Lines of notice/warning priority will be highlighted bold.
- The timestamps are converted into your local time-zone.
- The output is auto-paged with your pager of choice (defaults to less).
- This will show all available data, including rotated logs.
- Between the output of each boot we’ll add a line clarifying that a new boot begins now.
journalctl example commands
The first thing you need to know is that ‘journalctl’ has auto-completion, so TAB key is your friend.
Logs are viewed either by user root (sudo su) or by adding ‘sudo’ in front of each command.
View all logs, unfiltered:
View logs from this boot only:
View logs filtered by priority (“emerg”, “alert”, “crit”, “err”, “warning”, “notice”, “info”, “debug”):
journalctl -p crit
View error logs from this boot only:
journalctl -b -p err
View logs by service:
journalctl -u avahi-daemon.service
journalctl -u TAB TAB to see all services
View logs by service and append data as the log file grows (–follow)
journalctl -u httpd.service -f
View logs by PID:
View logs by timestamp:
journalctl –since=2014-12-22 –until="2014-12-23 19:30:45"
View logs by service and timestamp:
journalctl -u avahi-daemon.service –since=19:30 –until=20:30
View logs made by a specific executable:
View kernel logs:
View iptables logs:
journalctl -k | grep "IN=.*OUT=.*"
View journalctl logs from graphical interface
If you don’t want to use the command line for searching and viewing logs, there’s a graphical alternative for Fedora 21 called “Logs”.
To install it, open the Software installer and search for “Logs”.