Arch Linux Log Management Guide

Complete beginner-friendly guide to log management on Arch Linux, including journalctl, log rotation, log analysis, and log maintenance.

---

Table of Contents

1. systemd Journal
2. journalctl Usage
3. Log Rotation
4. Log Analysis
5. Troubleshooting

---

systemd Journal

Journal Location

Journal files:

# Journal location
/var/log/journal/

# User journal
~/.local/share/journal/

Journal Configuration

Configure journal:

# Edit config
sudo vim /etc/systemd/journald.conf

Settings:

[Journal]
Storage=persistent
SystemMaxUse=1G
SystemKeepFree=2G

---

journalctl Usage

View Logs

Basic commands:

# All logs
journalctl

# Recent logs
journalctl -n 50

# Follow logs
journalctl -f

# Boot logs
journalctl -b

Filter Logs

Filter by:

# By service
journalctl -u service-name

# By priority
journalctl -p err

# By time
journalctl --since today
journalctl --since "2024-01-15 10:00:00"

---

Log Rotation

Journal Rotation

Configure rotation:

# Edit config
sudo vim /etc/systemd/journald.conf

Settings:

SystemMaxUse=1G
SystemKeepFree=2G
MaxRetentionSec=1month

Manual Rotation

Rotate logs:

# Rotate journal
sudo journalctl --rotate

# Vacuum old logs
sudo journalctl --vacuum-time=2weeks
sudo journalctl --vacuum-size=1G

---

Log Analysis

Search Logs

Search:

# Search text
journalctl | grep error

# Case insensitive
journalctl | grep -i error

# With context
journalctl | grep -A 5 -B 5 error

Export Logs

Export:

# Export to file
journalctl > logs.txt

# Export specific service
journalctl -u service-name > service-logs.txt

---

Troubleshooting

Logs Too Large

Clean logs:

# Check size
journalctl --disk-usage

# Vacuum
sudo journalctl --vacuum-time=1week

Missing Logs

Check configuration:

# Check journal config
cat /etc/systemd/journald.conf

# Check journal status
systemctl status systemd-journald

---

Summary

This guide covered systemd journal, journalctl usage, log rotation, log analysis, and troubleshooting.

---

Next Steps

• Journalctl Troubleshooting - More on journalctl
• Arch Linux System Configuration - System setup
• ArchWiki Log Management: https://wiki.archlinux.org/title/Systemd/Journal

---

This guide is based on the ArchWiki. For the most up-to-date information, always refer to the official ArchWiki.