Reading the system log

    journalctl is your interface into a single machine’s journal/logging. All service files insert data into the systemd journal. There are a few helpful commands to read the journal:

    Read the entire journal

    $ journalctl
    
    -- Logs begin at Fri 2013-12-13 23:43:32 UTC, end at Sun 2013-12-22 12:28:45 UTC. --
    Dec 22 00:10:21 localhost systemd-journal[33]: Runtime journal is using 184.0K (max 49.9M, leaving 74.8M of free 499.0M, current limit 49.9M).
    Dec 22 00:10:21 localhost systemd-journal[33]: Runtime journal is using 188.0K (max 49.9M, leaving 74.8M of free 499.0M, current limit 49.9M).
    Dec 22 00:10:21 localhost kernel: Initializing cgroup subsys cpuset
    Dec 22 00:10:21 localhost kernel: Initializing cgroup subsys cpu
    Dec 22 00:10:21 localhost kernel: Initializing cgroup subsys cpuacct
    Dec 22 00:10:21 localhost kernel: Linux version 3.11.7+ ([email protected]) (gcc version 4.6.3 (Gentoo Hardened 4.6.3 p1.13, pie-0.5.2)
    ...
    1000s more lines
    

    Read entries for a specific service

    Read entries generated by a specific unit:

    $ journalctl -u apache.service
    
    -- Logs begin at Fri 2013-12-13 23:43:32 UTC, end at Sun 2013-12-22 12:32:52 UTC. --
    Dec 22 12:32:39 localhost systemd[1]: Starting Apache Service...
    Dec 22 12:32:39 localhost systemd[1]: Started Apache Service.
    Dec 22 12:32:39 localhost docker[9772]: /usr/sbin/apache2ctl: 87: ulimit: error setting limit (Operation not permitted)
    Dec 22 12:32:39 localhost docker[9772]: apache2: Could not reliably determine the server's fully qualified domain name, using 172.17.0.6 for ServerName
    

    Read entries since boot

    Reading just the entries since the last boot is an easy way to troubleshoot services that are failing to start properly:

    journalctl --boot
    

    Tail the journal

    You can tail the entire journal or just a specific service:

    journalctl -f
    
    journalctl -u apache.service -f
    

    Read entries with line wrapping

    By default journalctl passes FRSXMK command line options to less . You can override these options by setting a custom SYSTEMD_LESS environment variable with omitted S option:

    SYSTEMD_LESS=FRXMK journalctl
    

    Read logs without pager:

    journalctl --no-pager
    

    Debugging journald

    If you’ve faced some problems with journald you can enable debug mode following the instructions below.

    Enable debugging manually

    mkdir -p /etc/systemd/system/systemd-journald.service.d/
    

    Create a Drop-In /etc/systemd/system/systemd-journald.service.d/10-debug.conf with following content:

    [Service]
    Environment=SYSTEMD_LOG_LEVEL=debug
    

    And restart systemd-journald service:

    systemctl daemon-reload
    systemctl restart systemd-journald
    dmesg | grep systemd-journald
    

    Enable debugging via a Container Linux Config

    Define a Drop-In in a Container Linux Config :

    systemd:
      units:
        - name: systemd-journald.service
          dropins:
            - name: 10-debug.conf
              contents: |
                [Service]
                Environment=SYSTEMD_LOG_LEVEL=debug            
    

    More information

    Getting Started with systemd Network Configuration with networkd