Logging cheatsheet

Where your logs are

The log/ symbolic link joins a main service bundle to a logging service bundle. By convention, a further main/ symbolic link points to the main log output directory. So if one has obtained the location of the dbus service bundle with system-control find dbus one can, by convention, append log/main/ to find its log files.

readlink "`system-control find dbus`"/log/main

Where the log for the dbus service is.

readlink "`system-control find cron`"/log/main

Where the log for the cron service is.

readlink "`system-control find local-syslog-read`"/log/main

Where the output of C programs using the old syslog() mechanism is.

readlink `system-control find klogd`/log/main

Where the kernel log is.

A small list of useful commands relating to logging.

system-control status devd

Because the devd service has a log/main/ symbolic link, this command displays the last few lines of log output for the devd logging service.

svc -a "`system-control find devd`"/log/

Log services (running cyclog or multilog) can be told to explicitly rotate their output files. The major use case for this is to start a fresh current file for following as it is written.

find "`system-control find devd`"/log/main/ -type f -mtime -1 -print0 | \
xargs -0 sort -m -- | \
tai64nlocal | \
${PAGER:-more}

This finds the last 1 days' worth of log files in the "devd" log service's log output, combines them, decodes the timestamps, and paginates the result. The TAI64N timestamp in log files is sortable, and lines are already sorted within each log file (by the nature of logging), so sorting together multiple logs (which the find command is not guaranteed to emit in order) can be done with the -m (merge sort) option to the sort command.

tail -F "`system-control find dbus`"/log/main/current | tai64nlocal

This command displays the output of a log as it is written. The -F option to tail is the correct one to use, not the -f option. However, follow-log-directories fixes some of the problems even with tail -F.

tail -F "`system-control find dbus`"/log/main/current | \
grep -F --line-buffered 'PackageKit' | \
tai64nlocal

This command displays the filtered output of a log as it is written. The --line-buffered option stops grep -F from batching up the filtered lines and only spitting them out in lumps.