SystemD

In Ubuntu 16.04, the initialization system has changed. Sometimes this leads to a 502 error, because the Staffcop service does not start automatically. To solve this problem, you must explicitly allow the launch of this unit. sudo systemctl enable staffcop

Other commands for units: Launch unit immediately:

systemctl start unit

Stop unit immediately:

systemctl stop unit

Restart unit:

systemctl restart unit

Request unit to reset its settings:

systemctl reload unit

Show the status of the unit, and whether it is running or not:

systemctl status unit

Check if the unit is enabled in autorun when booting the system:

systemctl is-enabled unit

Add unit to autorun list at system boot:

systemctl enable unit

Remove unit from autorun list at system boot:

systemctl disable unit

Mask unit to make it impossible to launch:

systemctl mask unit

Unmask unit:

systemctl unmask unit

Show the page of the user manual related to the unit (requires support for this function in the specified unit file):

systemctl help unit

Reload systemd to find new or changed units:

systemctl daemon-reload

all the logs since the latest boot

journalctl -b

filter by date.

$ journalctl ---since yesterday
$ journalctl --since 09:00 --until now
$ journalctl --since 10:00 --until "1 hour ago"

filter by service

journalctl -u nginx.service

by service for a period of time.

journalctl -u nginx.service –since yesterday

journalctl -u nginx.service -u php-fpm.service —since today

by ID

journalctl _PID=381

by ID

journalctl _UID=33

who can be found in the logs

journalctl -F _UID

all filters

man systemd.journal-fields

look by path

journalctl /usr/bin/docker

what is for the kernel

journalctl -k

by error level

journalctl -k

errors are:

  • 0 - EMERG (the system is not operational);
  • 1 - ALERT (immediate intervention required);
  • 2 - CRIT (critical condition);
  • 3 - ERR (error);
  • 4 - WARNING (warning);
  • 5 - NOTICE (all’s well, but you should pay attention);
  • 6 - INFO (notification);
  • 7 - DEBUG (delayed printing).

output without less

journalctl --no-pager

log formats

journalctl  -u nginx.service -o json

like these ones

  • cat - only messages from logs without service fields;
  • export - binary format, suitable for export or backup logs;
  • short - syslog output format;
  • short-iso - syslog output format with time stamps in ISO 8601 format;
  • short-monotonic - syslog output format with monotonic time stamps (monotonic timestamp);
  • short-precise — syslog output format with accurate time marks (the time of events is specified with an accuracy of microseconds);
  • verbose - the most detailed format of data presentation (includes even those fields that are not displayed in other formats).

recent

journalctl -n

real time

journalctl -f

amount of logs

journalctl --disk-usage

decrease the logs size to

sudo journalctl --vacuum-size=1G

decrease the logs by time

sudo journalctl --vacuum-time=1years

same in the conf file

/еtc/systemd/journald.conf, which contain next parameters:
  • SystemMaxUse = maximum amount that logs can occupy on the disk;
  • SystemKeepFree = amount of free space that should remain on the disk aftersaving logs;
  • SystemMaxFileSize = size of the log file, after which it should be removed from the disk;
  • RuntimeMaxUse = maximum amount that logs can occupy in the /run file system;
  • RuntimeKeepFree = amount of free space that should remain in the /run file system after saving logs;
  • RuntimeMaxFileSize = the size of the log file on reaching which it’s deleted from /run filesystem.

Centralized storage of logs

systemd-journal-remote --url https://some.host:19531/