Linux

48314 readers

833 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
No misinformation
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago

MODERATORS

[email protected]

What do you use to analyze journalctl? (lemm.ee)

submitted 2 days ago* (last edited 2 days ago) by [email protected] to c/[email protected]

18 comments fedilink hide all child comments

Or any other log files/output? I'm open to any solution, but what I would like...

...is something where I can just click on a word or select some text and say "filter that out"

Something that colors different log levels differently, preferably automatically.

Something that can parse the "columns" and give me a nice quick list of values, like different unit names to filter out/solely include.

Something that lets me choose a time and go there. Something that lets me select only a specific timeframe of logs.

I know this can probably be done by going in/out of journalctl, recalling the last command and adding specific filter options... but it just feels slow. It's so many keypresses when I could just right click on the word and -> "Filter out/Search for" or something.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 1 points 2 days ago* (last edited 2 days ago) (1 children)

Sounds like you want a siem like Wazuh. Its agent can collect journald logs from any number of systems. It also has a gui you can interact with to parse logs.

[–] [email protected] 4 points 2 days ago* (last edited 2 days ago) (1 children)

Well, just a monitoring stack, like for example Grafana, would probably be more suitable for this specific task (if we're doing central hosting/collection).

Kind of my main recommendation is to use something with OpenTelemetry. It's pretty much the standard protocol for transferring logs, traces and metrics, so if you set everything up with that, then you can swap out the visualization software with less pain.
Here's a guide for Grafana + OpenTelemetry Collector: https://grafana.com/docs/loki/latest/send-data/otel/

[–] [email protected] 2 points 2 days ago

I'm seconding this recommendation