Linux Log Management with journalctl and rsyslog: Troubleshooting Like a Pro

Effective log management is key to troubleshooting.

journalctl Essentials

journalctl -f
journalctl -u nginx
journalctl -p err
journalctl --since "1 hour ago"
journalctl -k

Advanced Queries

journalctl _PID=1234
journalctl -b 0
journalctl -u nginx --output json-pretty
journalctl -u nginx --grep="404|500"

rsyslog

auth,authpriv.*          /var/log/auth.log
*.*;auth,authpriv.none   /var/log/syslog
*.err                    /var/log/errors.log
*.* @@logserver:514

Log Rotation

/var/log/nginx/*.log {
    daily
    rotate 30
    compress
    delaycompress
}

Troubleshooting Flow

journalctl -p err --since "10 minutes ago"
journalctl -k | grep -i "oom"
systemctl --failed

Master monitoring with our Monitoring eBook collection.