Bug 67748

Summary:	systemd-206: journalctl command should default to show entries from more recent time
Product:	systemd	Reporter:	Pacho Ramos <pachoramos1>
Component:	general	Assignee:	systemd-bugs
Status:	RESOLVED WORKSFORME	QA Contact:	systemd-bugs
Severity:	normal
Priority:	medium
Version:	unspecified
Hardware:	Other
OS:	All
Whiteboard:
i915 platform:		i915 features:

Description Pacho Ramos 2013-08-04 15:23:06 UTC

Currently, when I run "journalctl" I get log entries from a long time:
-- Logs begin at dom 2013-07-14 01:12:18 CEST, end at dom 2013-08-04 17:10:02 CEST. --
jul 14 01:12:18 belkin4 systemd-journal[89]: Runtime journal is using 1.0M (max 293.3M, leaving 440.0M of free 2.8G, current limit 293.3M).
jul 14 01:12:18 belkin4 systemd-journal[89]: Runtime journal is using 1.0M (max 293.3M, leaving 440.0M of free 2.8G, current limit 293.3M).
jul 14 01:12:18 belkin4 kernel: Initializing cgroup subsys cpuset
jul 14 01:12:18 belkin4 kernel: Initializing cgroup subsys cpu
jul 14 01:12:18 belkin4 kernel: Linux version 3.9.9-gentoo (root@belkin4) (gcc version 4.6.3 (Gentoo 4.6.3 p1.11, pie-0.5.2) ) #2 SMP PREEMPT Sat Jul 

This is a bit problematic because in each new day, log file grows more and more and, then, the pager used by journalctl (I think it's "less") is more and more slower to jump to the end of the log file.

This is the situation I see constantly:
1. I run "journalctl" to see recent logs.
2. It shows me the output since the first day, then, I press "End" key to jump to the end of the file and, after that, I want to go back some pages until I see where logs from this day are shown.

-> The problem is that, when I press "End" keyword, less takes a long time to jump to the end because log file is getting big.

My suggestion is that:
- "journalctl" should default to show logs from present day.
- People should use something like "journalctl --full" to show all logs, also oldest ones.

Thanks

Comment 1 Zbigniew Jedrzejewski-Szmek 2013-08-05 01:34:56 UTC

We have
- journalctl --since=today
- journalctl -e

The first does what you're requesting, but the second one might actually be more useful. journalctl --full does something completely different -- it shows lines without ellipsization.

Comment 2 Pacho Ramos 2013-08-05 17:12:06 UTC

Umm, "journalctl -e" would the enough for me, thanks :)

My suggestion was more related with current default -> maybe making "journalctl" behave as "-e" and tell people to use something like "journalctl --begin" would be better because usually last log entries are more useful than older ones

Comment 3 Zbigniew Jedrzejewski-Szmek 2013-08-07 02:00:25 UTC

(In reply to comment #2)
> Umm, "journalctl -e" would the enough for me, thanks :)
Great.

> My suggestion was more related with current default -> maybe making
> "journalctl" behave as "-e" and tell people to use something like
> "journalctl --begin" would be better because usually last log entries are
> more useful than older ones
Oh, we also have 'journalctl --reverse' :)

There's a general policy of keeping char-for-char compatibility between 'journactl' and 'cat /var/log/messages' or 'cat /var/log/syslog'. This is unlikely to change, because there are just too many other possible choices, and there's value in being able to say that "<(journalctl) replaces </var/log/messages exactly".

Comment 4 Pacho Ramos 2013-08-07 09:29:24 UTC

In that case, no problem, will run with proper option then ;)

Thanks a lot for your help!

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.