Using journalctl

[Alex]

Hi,

>> > I've used journalctl to do some really basic things, but I'm trying to
>> > use it to view the former /var/log/maillog, and haven't been able to
>> > figure out how.
>> >
>> > I understand I can use it to search for a specific priority, but
>> > haven't figure out how to show only today's mail.* facility logs,
>> > using the short form hostname. I also understand you can view logs for
>> > a specific process or pid, but that's also not what I want.
>> >
>> > Ideas greatly appreciated. A FAQ or general usage doc would really be
>> > appreciated (beyond just the man page). It just seems like a lot more
>> > typing than just "tail -f /var/log/maillog" when that's all I need.
>> >
>>
>> Assuming you're running sendmail, it sounds as if you may want....
>>
>> journalctl -b 0 -u sendmail
>>
>> or
>>
>> journalctl -b 0 -r -u sendmail
>>
>> And, there is the -f option, which is the same as tail's.
>
> Besides Ed's answer to your specific questions, you could look at this
> thread for a more general discussion.
>
> http://thread.gmane.org/gmane.linux.redhat.fedora.general/440292
>
> The OP has a useful (but incomplete) usage summary.  Also see this
> particular post:
>
> http://thread.gmane.org/gmane.linux.redhat.fedora.general/440292/focus=440535
>
> To add to that last post, SYSLOG_IDENTIFIER might be more human
> readable.  Although I have found often the information may not be
> commplete.  Sometimes part of the info is still classified as "from the
> unit file" and needs to be filtered with -u!

The solution to view the file formerly known as /var/log/maillog is:

# journalctl -f -l SYSLOG_FACILITY=2

The SYSLOG_FACILITY numbers corresponding to their values can be found here:

https://wiki.gentoo.org/wiki/Rsyslog

It used to be that typing "tail -f /var/log/maillog" was no big deal,
but now I'll have to create an alias to do the same thing, and every
general variation, ugh. On the mail servers, I'll probably just enable
syslog again.

Thanks,
Alex