2015-03-07 11:04 GMT+02:00 Tim <ignored_mailbox(a)yahoo.com.au>:
On Fri, 2015-03-06 at 08:28 -0700, Pete Travis wrote:
> No, the journalctl man page does not tell you about ntp logs, nor do
> the rsyslog pages explain grep :)
;-)
The man page suggested that the search parameter was a service name
(that I wouldn't know, at the time), as opposed to just being a keyword
I could supply to look for in a log entry.
It's still tediously slow to use, compared to the old messages text file
(which was only a recent log file, since the last rotation, not a huge
behemoth). I'm not convinced it's the best way to do things for those
that only need to do the occasional system administration (because,
generally, their computer just works fine).
You can limit the amount of data to be grepped or otherwise searched,
if you just tell journalctl to limit its output a bit. On a system
that is booted quite frequently, limiting oneself to just messages
since the last boot should work nicely:
journalctl -b | grep -i ntp
If your system has a long uptime, the -b option might produce a large
amount of data. In such a case, you might instead use the --since
option:
journalctl --since '-1 week' | grep -i ntp
I would usually let journalctl put the results in a pager (it does
that by default when not piping) and then use the search/filter
features of less to narrow down the results. These examples use grep,
though, because you seemed to prefer using it for searching.
-Joonas