Journald address one major issue with Linux applications logging, it provides a centralized management logging for the Kernel and the userland processes regardless where the logs are coming from. you can also use journald as an alternative looging driver inside Docker containers, this feature is available since Docker version 1.7.
To view logs written by journald you may use journalctl, it will show the full content of the journal when it's called without parameters:
To show all fields in full when the lines are very longs:
Use -r or –reverse to show newest entries first:
You can also use -n N or –lines=N to show the last N numbers, -e or –pager-end to view the end of the logs and -f or –follow to stream continuously journal entries. One of may favorite options to run journalctl is -u or –unit, this will show messages for the specific systemd unit entered or a matching pattern
You can use -p, –priority to filter messages by priority, Takes either a single numeric or textual log level (i.e. between 0/“emerg” and 7/“debug”). Accepted priorities are : “emerg” (0), “alert” (1), “crit” (2), “err” (3), “warning” (4), “notice” (5), “info” (6), “debug” (7).
When it is supported, you can use -x, –catalog to show explanation texts from the message catalog, this will supply you with explanation of the message and a possible solution or point you to external resources to resolve an issue:
journalctl in my opinion is a significant tool to use for debugging system and application issue, take the time to read the man page and practice using the above examples or from the man page.
References:
- journalctl man page.