Antw: [EXT] Re: Q: journalctl -b -g logrotate

["Ulrich Windl" <Ulrich.Windl@xxxxxxxxxxxxxxxxxxxx>]

>>> Mantas Mikulenas <grawity@xxxxxxxxx> schrieb am 05.04.2022 um 11:08 in
Nachricht
<CAPWNY8WgSRW2ewb3Fu+_XVdo7=C1m8YobWELsF3OE62pJ6vHhA@xxxxxxxxxxxxxx>:
> On Tue, Apr 5, 2022 at 9:36 AM Ulrich Windl <
> Ulrich.Windl@xxxxxxxxxxxxxxxxxxxx> wrote:
> 
>> Hi!
>>
>> I have two questions for "journalctl -b -g logrotate":
>>
>> 1) I'm unsure what the exact rules for matching a "-g expression" are:
>> Some kernel messages are matched, others not.
>>
> 
> All entries with a MESSAGE= are matched (after doing until/since/boot-id
> checks). They might still be hidden for other reasons though, e.g. messages
> containing weird escape characters (or accidental binary data) will be
> hidden unless you use -a.

And how do I find out whether a kernel message has a MESSAGE=?

As soon as I add _MESSAGE= I get no output any more (even with MESSAGE=.*).

> 
> 
>> 2) When the -b restricts messages to the current boot, why is output shown
>> like this?:
>> # journalctl -b -g logrotate
>> -- Logs begin at Wed 2020-11-25 11:27:53 CET, end at Tue 2022-04-05
>> 08:01:02 CEST. --
>>
>> I mean the boot was definitely in 2022, so I think the message is not
>> really helpful. Why not show the date and time when the search starts
(i.e.
>> boot time)?
>>
> 
> There's no such message in the current systemd version. See
> https://github.com/systemd/systemd/pull/21775.
> 
> 
>>
>> The next thing is "-k": If I supply it, kernel messages are _not_ found:
>> # journalctl -S 2022-04-02 -k | grep "OCFS2:" |head
>> # journalctl -S 2022-04-02 | grep "OCFS2:" |head
>> Apr 02 02:00:06 h18 kernel: OCFS2: ERROR (device dm-17):
>> ocfs2_validate_gd_self: Group descriptor #209970 has bad signature EXBLK01
>> Apr 02 02:00:06 h18 kernel: OCFS2: File system is now read-only.
>> Apr 02 02:00:07 h18 kernel: OCFS2: ERROR (device dm-17):
>> ocfs2_validate_gd_self: Group descriptor #209817 has bad signature EXBLK01
>> Apr 02 02:00:07 h18 kernel: OCFS2: ERROR (device dm-17):
>> ocfs2_validate_gd_self: Group descriptor #209946 has bad signature EXBLK01
>>
>> So can I find kernel messages from previous boots?
>>
> 
> `journalctl -k` is meant to imitate dmesg (except with correct timestamps),
> so it shows the current boot only. You can use _TRANSPORT=kernel to filter
> for kernel messages if you don't want that.
> 
> $ journalctl _TRANSPORT=kernel -g BogoMIPS

Yup, that works!

> 
> -- 
> Mantas Mikulėnas