Show Menu

Syslogd & Journal Cheat Sheet (DRAFT) by

Syslogd & Journal for RHCSA EX200

This is a draft cheat sheet. It is a work in progress and is not finished yet.


Shows more detailed inform­ation from the journal.
tail -f <lo­gfi­le>
Shows in real time which lines are added to the log file.
systemctl status <un­it>
Show a short overview of the last signif­icant events that have been logged by Systemd units through journald.
Enables users to write messages to rsyslog from the command line or a script
journalctl --since [--until]
to show all messages that have been written since given date (and up to, if provided)


Specifies a category of inform­ation that is logged. rsyslogd uses a fixed list of facili­ties, which cannot be extended. This is because of backward compat­ibility with the legacy syslog service.
Used to define the severity of the message that needs to be logged. When you specify a priority, by default all messages with that priority and all higher priorities are logged. This is a fixed list.
Defines where the message should be written. Typical destin­ations are files, but rsyslog modules can be used as a destin­ation as well, to allow further processing through a rsyslogd module.
local0 through local7
If services that do not have their own rsyslogd facility need to write log messages to a specific log file anyway, these services can be config­ured.
This directory is used for current process status inform­ation only, which means that the journal is cleared when the system reboots.


provides an advanced log management system. journald collects messages from the kernel, the entire boot procedure, and services and writes these messages to an event journal.
which is implem­ented by the system­d-j­ournald daemon
Non-pe­rsi­stent; however, forwarded to rsyslogd

Tips & Config­uration

Services and users can write directly to log files themselves or through rsyslogd.
You can configure the rsyslogd service through here.
If specific options need to be passed to the rsyslogd service on startup, you can do this by using this file.
(-) Buffered logging
Begin destin­ations with hyphens caused to have the log messages will not be immedi­ately committed to the file but instead will be buffered to make writes more efficient.
The default settings for log rotation are kept in here.
Specific logging config­ura­tions are placed here and override default config­ura­tions.
Create to make the journal persistent between system restarts.
Storing the journal perman­ently requires setting the Storag­e=auto parameter.