Logging on Documentationhttps://docs.ayshell.dev/tags/logging/Recent content in Logging on DocumentationHugo -- 0.147.5enMon, 30 Jun 2025 10:38:19 +0530Linux: Advanced Filtering and Analyzing System Logs with journalctlhttps://docs.ayshell.dev/posts/linux/journald/filters-journalctl/Mon, 30 Jun 2025 10:38:19 +0530https://docs.ayshell.dev/posts/linux/journald/filters-journalctl/<h1 id="what-is-journalctl-filters">What is <code>journalctl</code> Filters?</h1> <p>You can use filters with <code>journalctl</code> to narrow down and control which log entries are displayed. <code>journalctl</code> supports a wide range of filtering options, both by structured fields and by command-line flags.</p> <ul> <li>Structured Fields: <code>SYSLOG_IDENTIFIER</code>, <code>_SYSTEMD_UNIT</code>, <code>_UID</code>, etc</li> <li>Command-Line Fields: <code>--since</code>, <code>--until</code>, <code>-u</code>, <code>-p</code>, <code>--grep</code>, etc</li> </ul> <h2 id="common-journalctl-filters">Common <code>journalctl</code> Filters</h2> <table> <thead> <tr> <th>Filter Type</th> <th>Example Command</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>By Time</td> <td><code>journalctl --since &quot;8 hours ago&quot;</code></td> <td>Shows logs since a specific time</td> </tr> <tr> <td>By Service/Unit</td> <td><code>journalctl -u nginx.server</code></td> <td>Show logs for a specific server/unit</td> </tr> <tr> <td>By Priority</td> <td><code>journalctl -p warning</code></td> <td>Show logs at/above a certain severity</td> </tr> <tr> <td>By Field</td> <td><code>journalctl SYSLOG_IDENTIFIER=sudo</code></td> <td>Show logs where a field matches a value</td> </tr> <tr> <td>By Boot</td> <td><code>journalctl -b -1</code></td> <td>Shows logs from the previous boot</td> </tr> <tr> <td>By Keyword</td> <td><code>journalctl --grep &quot;error&quot;</code></td> <td>Shows logs containing a keyword</td> </tr> </tbody> </table> <h3 id="advanced-journalctl-filters">Advanced <code>journalctl</code> Filters</h3> <table> <thead> <tr> <th>Filter Type</th> <th>Example Command</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>By User ID</td> <td><code>journalctl _UID=user_id</code></td> <td>Filter logs by the user ID of the process that generated them</td> </tr> <tr> <td>By Group ID</td> <td><code>journalctl _GID=group_id</code></td> <td>Filter logs by the group ID of the process that generated them</td> </tr> <tr> <td>By Process ID</td> <td><code>journalctl _PID=process_id</code></td> <td>Filter logs by process ID</td> </tr> <tr> <td>By Process name</td> <td><code>journalctl _COMM=nginx</code></td> <td>Filter by process name (eg. <code>_COMM=nginx</code>)</td> </tr> <tr> <td>By Hostname</td> <td><code>journalctl _HOSTNAME=hostname</code></td> <td>Filter logs by hostname</td> </tr> <tr> <td>By Executable Path</td> <td><code>journalctl _EXE=exe_path</code></td> <td>Filter logs by executable path (eg: <code>/usr/local/bin/hugo</code>)</td> </tr> <tr> <td>By Boot Session</td> <td><code>journalctl _BOOT_ID=boot_id</code></td> <td>Filter logs by a specific boot session</td> </tr> <tr> <td>By Audit Session</td> <td><code>journalctl _AUDIT_SESSION=session_id</code></td> <td>Filter logs by audit session ID</td> </tr> <tr> <td>By Syslog Facility Code</td> <td><code>journalctl _SYSLOG_FACILITY=facility_number</code></td> <td>Filter by syslog facility code</td> </tr> </tbody> </table> <p><strong>Alternatively</strong>, you can find the available filters in <code>journalctl</code> by using:</p>Linux: Log Analysis and Journalshttps://docs.ayshell.dev/posts/linux/journald/journalctl/Sun, 22 Jun 2025 14:15:38 +0530https://docs.ayshell.dev/posts/linux/journald/journalctl/Understanding Linux log locations, using journalctl, analyzing traditional logs, filtering and searching logs with grep, less and time filters.