===== Manage journal services =====

==== Systemd debug mode ====

Add the following lines to /etc/systemd/system.conf
  LogLevel=debug
  LogTarget=syslog-or-kmsg
  SysVConsole=yes
  
Output will be printed to console.

==== journalctl command ====

A new service 

Show all boot messages: 
<cli prompt='#'>
  # journalctl -b    : Show all messages from this boot
  # journalctl -b -0 : shows messages from the current boot
  # journalctl -b -x : shows messages from the last x boot time
</cli>
  
Show all messages from date (and optional time):
<cli prompt='#'>
  # journalctl --since="2012-10-30 18:17:16"
</cli>

Show all messages since 20 minutes ago:
<cli prompt='#'>
  # journalctl --since "20 min ago"
  # journalctl --since 17:10 --until 17:30
</cli>

Follow new messages (like: tail -f /var/log/messages):
<cli prompt='#'>
  # journalctl -f
</cli>

List only the 25 last entries: 
<cli prompt='#'>
  # journalctl -n 
</cli>

List only errors: 
<cli prompt='#'>
  # journalctl -p err
</cli>
  
List detailled: 
<cli prompt='#'>
  # journalctl -o verbose
</cli>

List whole line: 
<cli prompt='#'>
  # journalctl -o verbose --no-pager
</cli>
  
Show all messages by a specific executable:
<cli prompt='#'>
  # journalctl /usr/lib/systemd/systemd
</cli>

Filter by command (or _EXE for executable):
<cli prompt='#'>
  # journalctl --since=today _COMM=sshd
</cli>

==== journal persistent ====

Create a directory to store journal
<cli prompt='#'>
# mkdir /var/log/journal
# chown root.systemd-journal /var/log/journal
# chmod 2755 /var/log/journal
# killall -USR1 systemd-journal
Or
# systemctl restart systemd-journald
</cli>

Change journal parameters (default space max used for journal is 10% of the filesystem containing /var/log) 
<cli prompt='#'>
# vi /etc/systemd/journald.conf
[Journal]
...
SystemMaxUse=500M
SystemMaxFileSize=50M
ForwardToSyslog=yes
....
# systemctl restart systemd-journald
</cli>