การบันทึกเหตุการณ์แบบรวมศูนย์และการหมุนเวียนด้วย journald และ logrotate

Cron jobs, systemd services, and shell functions all produce output. To run unattended systems you must capture, search, and rotate that output. Enter journalctl and logrotate.

systemd-journald collects logs from services you manage with systemctl into a structured binary journal you query with journalctl.

Plain journalctl shows everything; -e jumps to the end (newest entries).

-u limits the journal to one unit, perfect for debugging a single service.

-f streams new entries as they arrive, like tail -f for systemd.

--since and -p narrow results. Here we show errors from the last hour.

Journals can grow large. --vacuum-size trims them to a target size.

Many apps still write to /var/log/*.log. logrotate rotates, compresses, and deletes these on a schedule so disks do not fill.

Drop a config in /etc/logrotate.d/. This rotates daily, keeps 7 copies, and compresses old ones.

-d does a debug dry run that shows what would happen without changing files; -f forces an immediate rotation.

Have cron jobs and functions log to a dedicated file, manage that file with a logrotate rule, and use journalctl for everything run as a systemd service. Now nothing fills the disk silently.

Which journalctl option shows logs for a single systemd service?

You can keep automated systems observable and tidy:

• journalctl -u, -f, --since, -p query systemd logs
• --vacuum-size trims the journal
• logrotate rotates/compresses plain-text logs via /etc/logrotate.d/
• logrotate -d dry-runs your config