replacing rsyslogd in minimal with journald [was Re: systemd requires HTTP server and serves QR codes]

[Tom Hughes]

On 09/10/12 15:04, Lennart Poettering wrote:

> h) It's much shorter to type: "journalctl" than "less
>     /var/log/messages". "journalctl -n" is shorter than "tail
>     /var/log/messages". And "journalctl -f" is shorter than "tail -f
>     /var/log/messages".

While "less" helpfully wraps your log lines at the edge of your terminal 
journalctl unhelpfully truncates them or, if -a is used, makes you use 
left/right cursor to scroll back and forth in an attempt to read the 
lines. Especially since it fully qualifies the host name so the actual 
message has barely got started by column 80.

More importantly though, what is the equivalent of "fgrep xxx 
/var/log/messages" which is certainly pretty much the most common thing 
I do on my logs... I can't see any sort of searching in journalctl?

The next most common thing I probably do is to load the log into vi so I 
can search back and forth to see matches in context, but obviously that 
is not something journalctl is every really going to be able to do.

I love the idea of the journal, just don't think the tools are quite 
there yet.

Tom

-- 
Tom Hughes (tom at compton.nu)
http://compton.nu/