Linux system logs with journalctl

journalctl

! https://phoenixnap.com/kb/how-to-view-read-linux-log-files
https://www.ubuntupit.com/best-linux-log-viewer-and-log-file-management-tools/

log file locations

Most Linux log files are stored in a plain ASCII text file and are in the ==/var/log directory== and subdirectories.
Logs are generated by the Linux system daemon log, syslogd or rsyslogd.
List of some useful log files :
/var/log/boot.log
/var/log/daemon.log
/var/log/dmesg
/var/log/kern.log
/var/log/messages
/var/log/Xorg.x.log

The following website provides a modest explanation of what’s contained in each log file: http://www.thegeekstuff.com/2011/08/linux-var-log-files/

usage

line output is cut of at terminal length , to see remainder part(s) use right arrow

config

The systemd journal by default retains 4GB of data
https://andreaskaris.github.io/blog/linux/setting-journalctl-limits/

set a permanent maximum of seven log files to keep , which equals seven boot logs :
sudo sed -i 's/#SystemMaxFiles=100/SystemMaxFiles=7/g' /etc/systemd/journald.conf
restart the journal service:
sudo systemctl restart systemd-journald.service

actions

read the system journal and go staright to the latest part :
journalctl -e

compress the current systemd logs to 50MB in total
sudo journalctl --vacuum-size=50M

Boot Messages

# last boot
journalctl -b
# previous boot  (  or before previous = -2  etc ) 
journalctl -b -1
# all boots
journalctl --list-boots

Time
journalctl --since "1 hour ago"

Service
journalctl -u mssql-server.service