Hi! I have two questions for "journalctl -b -g logrotate":
1) I'm unsure what the exact rules for matching a "-g expression" are: Some kernel messages are matched, others not. 2) When the -b restricts messages to the current boot, why is output shown like this?: # journalctl -b -g logrotate -- Logs begin at Wed 2020-11-25 11:27:53 CET, end at Tue 2022-04-05 08:01:02 CEST. -- I mean the boot was definitely in 2022, so I think the message is not really helpful. Why not show the date and time when the search starts (i.e. boot time)? The next thing is "-k": If I supply it, kernel messages are _not_ found: # journalctl -S 2022-04-02 -k | grep "OCFS2:" |head # journalctl -S 2022-04-02 | grep "OCFS2:" |head Apr 02 02:00:06 h18 kernel: OCFS2: ERROR (device dm-17): ocfs2_validate_gd_self: Group descriptor #209970 has bad signature EXBLK01 Apr 02 02:00:06 h18 kernel: OCFS2: File system is now read-only. Apr 02 02:00:07 h18 kernel: OCFS2: ERROR (device dm-17): ocfs2_validate_gd_self: Group descriptor #209817 has bad signature EXBLK01 Apr 02 02:00:07 h18 kernel: OCFS2: ERROR (device dm-17): ocfs2_validate_gd_self: Group descriptor #209946 has bad signature EXBLK01 So can I find kernel messages from previous boots? (systemd-246.16-150300.7.39.1.x86_64 of SLES15 SP3) Regards, Ulrich
