On Mar 4, 2015 8:41 AM, <aragonx(a)dcsnow.com> wrote:
> On Tue, 3 Mar 2015 13:46:43 +1000
> Dan Irwin wrote:
>
>> Hi all,
>>
>> What kind of secret voodoo does one need to use rsyslog on a systemd
>> system? Is it even possible?
>
> From my notes on making fedora usable:
>
> rsyslog isn't installed by default, so you get no log files
> you can look at with normal tools. The systemd journal has
> taken over. To restore sanity:
Doesn't this depend on what version you install? I think the workstation
version does not include rsyslog whereas the server version does.
I too found it more than a little concerning when I was trying to help
troubleshoot
an issue on one of our admin's systems. I logged in, did a
less /var/log/messages and got a "No such file or directory" error. When
you have been doing the same thing for over 20 years like I have, it's very
shocking, like one day you go home and suddenly someone has moved your
house and you have no idea where it went to.
Is there really a good reason to not use the messages file anymore?
---
Will Y.
--
"I'm used to something else" is not a valid technical complaint. Not to
say that your *surprise* isn't valid, but you don't have to go through all
this work to get the information you are looking for. It is already in the
journal. Following Tom's instructions just allows you to access the logs
by typing "less /var/log/messages" - and ensures you cannot use journalctl
to see logs from previous boots.
If you're open to typing a different command to access logs, here are a few
you might find interesting:
Show all logs ever, with a less-like parser:
# journalctl
Show logs only from this boot:
# journalctl -b
Show kernel messages (ie dmesg output) from the previous boot:
# journalctl -k -b -1
Show any message from the last five minutes:
# journalctl --since -5m
Follow messages from the ssh daemon:
# journalctl -f -u sshd.service
Messages from a given user from the current boot without parser formatting:
# journalctl -b _UID=1045 -o cat
Many other filter options are explained in `man journalctl`. If you learn
them, I think you will find it to be a much more direct way to
troubleshoot; instead of conjuring sed/awk/grep invocations to compare the
state of various services at a given time and filter out the irrelevant
stuff, use journalctl query arguments.
--Pete