#journalctl

12 one-liners with this tag.

Count IP addresses blocked by ufw

#journalctl -k --since "today" --no-pager | grep 'UFW BLOCK' | grep -o 'SRC=[^ ]*' | sort | uniq -c | sort -rn | head -20

harmlessFirewall

Find processes killed by the OOM killer

#journalctl -k --no-pager | grep -iE "out of memory|oom-kill|killed process"

harmlessProcesses

IP addresses with the most failed SSH logins

#journalctl -u ssh --since "24 hours ago" --no-pager | grep -oE 'Failed password for .* from [0-9a-f.:]+' | awk '{print $NF}' | sort | uniq -c | sort -rn | head -20

harmlessSecurity

Show commands run with sudo from the journal

#journalctl _COMM=sudo --since "7 days ago" --no-pager | grep 'COMMAND='

harmlessSecurity

Show disk space used by the systemd journal

#journalctl --disk-usage

harmlesssystemd

Show journal logs for a single service

#journalctl -u nginx -n 200 --no-pager

Show logs from the previous boot

#journalctl -b -1 -n 200 --no-pager

Show only error messages in the system journal

#journalctl -p err -b --no-pager

Show successful SSH logins from the journal

#journalctl -u ssh --since "7 days ago" --no-pager | grep 'Accepted'

Show system logs since a specific time

#journalctl --since "1 hour ago" --no-pager

Show the cron log: when which job ran

#journalctl -u cron --since today --no-pager

Shrink the systemd journal to a maximum size

#journalctl --vacuum-size=500M

destructivesystemd