Linux logs and time cheat sheet

The chapter on one page: what to remember, the commands to have at your fingertips, and flashcards for quick revision.

The chapter in eight sentences

Services log to journald, which keeps a structured journal; rsyslog copies messages into text files such as /var/log/messages and /var/log/secure.
journalctl filters by unit (-u), priority (-p), boot (-b), time (--since, --until), pattern (-g) and follows live with -f.
Priorities run from 0 (emerg) to 7 (debug); -p err shows levels 0 to 3.
The journal is volatile unless /var/log/journal exists; create it, restart journald and run journalctl --flush, and limit its size with a drop-in in /etc/systemd/journald.conf.d/.
Custom log files come from a rule in /etc/rsyslog.d/ (local5.* /var/log/NAME.log) and logger; logrotate rules in /etc/logrotate.d/ keep them in check.
timedatectl shows and sets the time zone; with NTP active, the clock cannot be set by hand.
chrony follows NTP sources from /etc/chrony.conf; chronyc sources marks the selected one with *, chronyc tracking shows the offset.
Diagnose in order: symptom, systemctl status, journalctl -u, wider logs (-p err, dmesg, last), one change, verify.

Item	Detail
Persistent journal	`mkdir /var/log/journal`; `systemctl restart systemd-journald`; `journalctl --flush`
Limits	`/etc/systemd/journald.conf.d/10-X.conf`: `SystemMaxUse=`
Clean up	`journalctl --vacuum-size=100M` · `--vacuum-time=2weeks`
rsyslog rule	`/etc/rsyslog.d/10-X.conf`: `local5.* /var/log/X.log`; restart rsyslog
logrotate rule	`/etc/logrotate.d/X`: `weekly`, `rotate N`, `compress`, `create`
Test / force	`logrotate -d FILE` · `logrotate -f FILE`

Command	Does
`timedatectl`	Clock, zone, sync state
`timedatectl list-timezones`	Zone names
`timedatectl set-timezone Asia/Colombo`	Set zone
`timedatectl set-ntp true\|false`	NTP on or off
`chronyc sources` / `tracking`	Sources / offset
`/etc/chrony.conf`	`pool` or `server NAME iburst`
`systemctl restart chronyd`	Apply changes

journald versus rsyslog?: journald keeps a structured journal (journalctl); rsyslog writes plain text files in /var/log.
Log of one service, this boot, errors only?: journalctl -u NAME -b -p err
Follow the log live; filter by time?: journalctl -f · journalctl --since "1 hour ago" --until now
Which file holds logins and sudo records?: /var/log/secure
Write a test message to the logs?: logger -p user.notice "text"
Make the journal persistent?: mkdir /var/log/journal; systemctl restart systemd-journald; journalctl --flush
Add a custom log file for a facility?: /etc/rsyslog.d/10-NAME.conf with 'local5.* /var/log/NAME.log'; restart rsyslog
Test and force a log rotation?: logrotate -d FILE · logrotate -f FILE
Show clock, zone and sync state; set the zone?: timedatectl · timedatectl set-timezone Area/City
Check NTP sources and offset?: chronyc sources · chronyc tracking
Kernel messages?: dmesg -T · journalctl -k
Six-step diagnosis?: Symptom, status, log around the failure, widen, one change, verify.