The log lines that were never written down — cheat sheet
logging-journald
# querying
journalctl -u UNIT -b # unit, this boot (includes logger lines from its processes)
journalctl -t IDENTIFIER # by syslog identifier
journalctl -p err -b # priority 3 and worse: 0 emerg 1 alert 2 crit 3 err 4 warning 5 notice 6 info 7 debug
journalctl --since '10 min ago' --until now
journalctl _SYSTEMD_INVOCATION_ID=ID # one run (while the unit still has one)
journalctl -k -b ; journalctl -b -1 # kernel ; previous boot
journalctl -u UNIT -o json | head -1 # the real fields — why a filter does not match
journalctl -o cat # messages only
# rate limiting
journalctl -b | grep Suppressed # "Suppressed N messages from UNIT" — after the interval
# journald.conf RateLimitIntervalSec=30s RateLimitBurst=10000 (burst scaled by free disk space)
# unit LogRateLimitIntervalSec= LogRateLimitBurst= (0 = off for that unit)
journalctl -t rsyslogd | grep rate # rsyslog imjournal drops, a separate limit
# priorities from a service
# stdout and stderr → 6 (info); echo "<3>message" → 3 (err); logger -p user.warning → 4
# storage
journalctl --disk-usage ; journalctl --list-boots
journalctl -u systemd-journald -b | grep 'System Journal' # current size, max, free
journalctl --vacuum-size=500M ; journalctl --vacuum-time=2weeks
systemd-analyze cat-config systemd/journald.conf # merged configuration