Embedded Files
Q1 Configure Persistent Journaling
Q1 Configure Persistent Journaling
By default, the systemd-journald logs are volatile and lost after a reboot. Configure the system so that journal logs are stored persistently on the disk.
Solution
Open configuration file by vim
sudo vim /usr/lib/systemd/journald.conf
or sudo vim /etc/systemd/journal.conf
Press Esc --> I
Verify/Edit configuration file to auto
Remain #
#Storage=auto
Press Esc --> :wq (or :q! if nothing is edited)--> Enter
Manual create /var/log/journal
mkdir /var/log/journal
Restart journalctl
systemctl restart systemd-journald
Flush Journal
journalctl --flush
Check machine ID
cat /etc/machine-id
Verify
The machine ID subdirectory has been created inside /var/log/journal.
ls -la /var/log/journal
Cleanup
sudo systemctl stop systemd-journald.service systemd-journald.socket
rm -rf /var/log/journal
systemctl start systemd-journald
ls /var/log/journal (/var/log/journal should not be found)
Q2 Log Filtering and Extraction
Q2 Log Filtering and Extraction
A recent application issue caused several errors today. Use journalctl to find all messages with a priority of err (error) or higher that have occurred since today. Save the output of this command to a file named /root/today_errors.txt.
Solution
journalctl -p err --since today > /root/today_errors.txt
Q3 Verify Logging Services
Q3 Verify Logging Services
Ensure that the rsyslog service is currently running and enabled to start automatically at boot. Additionally, verify that the logrotate timer is active so that old logs will be compressed and rotated automatically.
Solution
Enable and start rsyslog at boot
systemctl enable --now rsyslog
systemctl start rsyslog
Check the status of logrotate timer
systemctl status logrotate.timer
Page updated
Google Sites
Report abuse