RH124 Ch 11: Logs, the Journal and Time

RHEL logs through two cooperating services. systemd-journald collects messages from the kernel, services and logger; rsyslog reads the journal and writes classic text files in /var/log (messages, secure, cron, maillog).

journalctl - journalctl -u sshd one unit, -t tag one identifier, -p err priority err and worse. - --since "2026-11-01 08:00" --until "1 hour ago", -b this boot, -b -1 previous boot, -f follow, -o verbose all fields. - Priorities from most to least severe: emerg, alert, crit, err, warning, notice, info, debug.

Persistent journal: by default (Storage=auto) the journal is kept only if /var/log/journal exists. Set Storage=persistent under [Journal] in /etc/systemd/journald.conf (or a drop-in in journald.conf.d/) and systemctl restart systemd-journald. Then journalctl -b -1 works after a reboot.

rsyslog rules are facility.priority destination, e.g. local5.debug /var/log/app.log or .info;mail.none /var/log/messages. Put your own in /etc/rsyslog.d/.conf, restart rsyslog, and test with logger -p local5.info "test". logrotate keeps the files from growing forever.

Time - timedatectl shows clock, time zone and NTP sync; timedatectl set-timezone Asia/Kolkata; timedatectl list-timezones. - chronyd is the NTP client. In /etc/chrony.conf use server host iburst (one server) or pool name iburst (several), then systemctl restart chronyd and check chronyc sources -v (^ marks the source in use).

Exam traps: editing chrony.conf without restarting; making the journal persistent with only mkdir when the config says volatile; wrong facility name in rsyslog.