Re: [gentoo-user] I don't seem to have a system log. Help, please!

[Rich Freeman]

On Mon, Feb 9, 2015 at 6:52 AM, Alec Ten Harmsel
<alec@××××××××××××××.com> wrote:
>
> On 02/09/2015 06:49 AM, Mick wrote:
>> On Monday 09 Feb 2015 11:23:15 Rich Freeman wrote:
>>> You don't have to export them from anything unless you need their
>>> content in a text file.  If you just run "journalctl" that is the
>>> equivalent of typing cat /var/log/messages.  If you do want to parse
>>> them with an external tool then you get your choice of several text
>>> formats and json.
>> The thing is I never use cat.  I invariably use less, rview, or grep, to
>> browse or search the log files.
>>
>> How will this work with journalctl, will I have to export them first into a
>> different format?
>>
>
> You can run `journalctl | grep whatever`. I don't know what rview is,
> but as long as whatever you're using supports pipes you should be fine.
>

Keep in mind that if you're grepping logs, there is probably a better
way to accomplish what you want to do with journalctl's options.
Finding all output from a particular daemon is going to be more
reliable if you filter by unit, versus getting verbose log output from
your mail server that has "mysql" somewhere in it or whatever.  That
is the main reason for using a binary log format.

But, yes, you can just pipe the output into the tool of your choice.
If you keep a lot of logs like I do it might be wiser to prefilter it
a bit, such as by adding -b to the options to limit it to entries
since the last reboot.

I also tend to keep a journalctl -f running in a screen session, which
is the equivalent of a tail -f.

If you're using an automated tool you can also use cursors to bookmark
the last entry you read and then ask journalctl for entries since that
one.  Of course, an automated tool would probably just read the logs
via dbus or whatever (I haven't taken the time to look into the APIs).

-- 
Rich