Linux Journal Log Export: Systemd Journald Analysis and Log Management

Systemd Journal Overview

Systemd journald is the central logging service on modern Linux systems. It captures logs from all services, the kernel, and user processes in a structured binary format that enables powerful filtering and analysis.

Journal Statistics

journalctl --disk-usage
journalctl --list-boots
journalctl --verify

Filtering by Priority

journalctl -p err  # errors and above
journalctl -p warning  # warnings and above
journalctl -p 0..3  # emergency through error

Filtering by Unit

journalctl -u nginx.service
journalctl -u sshd.service --since "1 hour ago"
journalctl --field=_SYSTEMD_UNIT

Exporting Logs

# Export to file
journalctl --since "24 hours ago" > /tmp/logs-24h.txt

# Export as JSON
journalctl -o json --since today > /tmp/logs.json

# Export specific unit
journalctl -u nginx -o export > /tmp/nginx.journal

Journal Management

# Rotate and vacuum
journalctl --rotate
journalctl --vacuum-size=500M
journalctl --vacuum-time=30d

Automated Export with dargslan-journal-export

pip install dargslan-journal-export
dargslan-journal-export
dargslan-journal-export --stats
dargslan-journal-export --priorities
dargslan-journal-export --recent 24 -o /tmp/logs.txt