On Tue, Apr 5, 2022 at 9:36 AM Ulrich Windl <Ulrich.Windl@xxxxxxxxxxxxxxxxxxxx> wrote:
Hi!
I have two questions for "journalctl -b -g logrotate":
1) I'm unsure what the exact rules for matching a "-g _expression_" are: Some kernel messages are matched, others not.
All entries with a MESSAGE= are matched (after doing until/since/boot-id checks). They might still be hidden for other reasons though, e.g. messages containing weird escape characters (or accidental binary data) will be hidden unless you use -a.
2) When the -b restricts messages to the current boot, why is output shown like this?:
# journalctl -b -g logrotate
-- Logs begin at Wed 2020-11-25 11:27:53 CET, end at Tue 2022-04-05 08:01:02 CEST. --
I mean the boot was definitely in 2022, so I think the message is not really helpful. Why not show the date and time when the search starts (i.e. boot time)?
There's no such message in the current systemd version. See https://github.com/systemd/systemd/pull/21775.
The next thing is "-k": If I supply it, kernel messages are _not_ found:
# journalctl -S 2022-04-02 -k | grep "OCFS2:" |head
# journalctl -S 2022-04-02 | grep "OCFS2:" |head
Apr 02 02:00:06 h18 kernel: OCFS2: ERROR (device dm-17): ocfs2_validate_gd_self: Group descriptor #209970 has bad signature EXBLK01
Apr 02 02:00:06 h18 kernel: OCFS2: File system is now read-only.
Apr 02 02:00:07 h18 kernel: OCFS2: ERROR (device dm-17): ocfs2_validate_gd_self: Group descriptor #209817 has bad signature EXBLK01
Apr 02 02:00:07 h18 kernel: OCFS2: ERROR (device dm-17): ocfs2_validate_gd_self: Group descriptor #209946 has bad signature EXBLK01
So can I find kernel messages from previous boots?
`journalctl -k` is meant to imitate dmesg (except with correct timestamps), so it shows the current boot only. You can use _TRANSPORT=kernel to filter for kernel messages if you don't want that.
$ journalctl _TRANSPORT=kernel -g BogoMIPS
Mantas Mikulėnas
