On Tue, Apr 5, 2022 at 9:36 AM Ulrich Windl < ulrich.wi...@rz.uni-regensburg.de> wrote:
> Hi! > > I have two questions for "journalctl -b -g logrotate": > > 1) I'm unsure what the exact rules for matching a "-g expression" are: > Some kernel messages are matched, others not. > All entries with a MESSAGE= are matched (after doing until/since/boot-id checks). They might still be hidden for other reasons though, e.g. messages containing weird escape characters (or accidental binary data) will be hidden unless you use -a. > 2) When the -b restricts messages to the current boot, why is output shown > like this?: > # journalctl -b -g logrotate > -- Logs begin at Wed 2020-11-25 11:27:53 CET, end at Tue 2022-04-05 > 08:01:02 CEST. -- > > I mean the boot was definitely in 2022, so I think the message is not > really helpful. Why not show the date and time when the search starts (i.e. > boot time)? > There's no such message in the current systemd version. See https://github.com/systemd/systemd/pull/21775. > > The next thing is "-k": If I supply it, kernel messages are _not_ found: > # journalctl -S 2022-04-02 -k | grep "OCFS2:" |head > # journalctl -S 2022-04-02 | grep "OCFS2:" |head > Apr 02 02:00:06 h18 kernel: OCFS2: ERROR (device dm-17): > ocfs2_validate_gd_self: Group descriptor #209970 has bad signature EXBLK01 > Apr 02 02:00:06 h18 kernel: OCFS2: File system is now read-only. > Apr 02 02:00:07 h18 kernel: OCFS2: ERROR (device dm-17): > ocfs2_validate_gd_self: Group descriptor #209817 has bad signature EXBLK01 > Apr 02 02:00:07 h18 kernel: OCFS2: ERROR (device dm-17): > ocfs2_validate_gd_self: Group descriptor #209946 has bad signature EXBLK01 > > So can I find kernel messages from previous boots? > `journalctl -k` is meant to imitate dmesg (except with correct timestamps), so it shows the current boot only. You can use _TRANSPORT=kernel to filter for kernel messages if you don't want that. $ journalctl _TRANSPORT=kernel -g BogoMIPS -- Mantas Mikulėnas