LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 08-20-2018, 05:36 AM   #1
twan163
LQ Newbie
 
Registered: Aug 2018
Posts: 4

Rep: Reputation: Disabled
example or use case for journalctl and tomorrow


While studying for the RHCSA exam, I was doing research in the man page for journalctl. I understand the use of "--since" and "--until", in combination with the strings "yesterday" or "today". But I can't imagine a case in which I could use the "tomorrow" string, like in
Code:
journalctl --since today --until tomorrow
What's the use of "tomorrow", if the moment I am looking at the logs, there won't be any log entries for "tomorrow"?
I there anyone who can provide an example or a use case? It would be much appreciated.
 
Old 08-20-2018, 07:38 AM   #2
MensaWater
LQ Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, CoreOS, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 7,831
Blog Entries: 15

Rep: Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669Reputation: 1669
That would show all of today's messages without having to specify an exact end time for "today".

That is to say if you were checking at 10 AM you would only have message up to 10 AM. If you were checking at 7 PM you'd have more messages up through 7 PM. Rather than having to specify 10 AM or 7 PM if you specify "tomorrow" it will find all matching records which at 10 AM "today" would only be those to 10 AM but at 7 PM "today" would be those to 7 PM. This way you can always specify the same syntax to get "today" messages no matter what time "today" you are running the command.
 
Old 08-20-2018, 01:50 PM   #3
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 21,864

Rep: Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311
--until tomorrow is probably useless, but syntactically correct.
where is this example coming from?
 
Old 08-21-2018, 07:17 AM   #4
twan163
LQ Newbie
 
Registered: Aug 2018
Posts: 4

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by MensaWater View Post
That would show all of today's messages without having to specify an exact end time for "today".

That is to say if you were checking at 10 AM you would only have message up to 10 AM. If you were checking at 7 PM you'd have more messages up through 7 PM. Rather than having to specify 10 AM or 7 PM if you specify "tomorrow" it will find all matching records which at 10 AM "today" would only be those to 10 AM but at 7 PM "today" would be those to 7 PM. This way you can always specify the same syntax to get "today" messages no matter what time "today" you are running the command.
I think I understand what you are saying, unless I am missing something in your reply. But in that case I would rather use the command
Code:
journalctl --since today
Without "--until", as this seems to always give me the most recent journal entries, with "today" starting at "00:00:00".
 
Old 08-21-2018, 07:28 AM   #5
twan163
LQ Newbie
 
Registered: Aug 2018
Posts: 4

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by pan64 View Post
--until tomorrow is probably useless, but syntactically correct.
where is this example coming from?
I have found mention of "tomorrow" in the man page for "journalctl". Under the options "--since" and "--until".
Quote:
-S, --since=, -U, --until=
Start showing entries on or newer than the specified date, or on or
older than the specified date, respectively. Date specifications
should be of the format "2012-10-30 18:17:16". If the time part is
omitted, "00:00:00" is assumed. If only the seconds component is
omitted, ":00" is assumed. If the date component is omitted, the
current day is assumed. Alternatively the strings "yesterday",
"today", "tomorrow" are understood, which refer to 00:00:00 of the
day before the current day, the current day, or the day after the
current day, respectively. "now" refers to the current time.
Finally, relative times may be specified, prefixed with "-" or "+",
referring to times before or after the current time, respectively.
For complete time and date specification, see systemd.time(7).
The use of "--since tomorrow" seems nonsense to me. So I assume the only logical place to use "tomorrow", would be with "--until".
What I can't wrap my head around is that the moment I use journalctl, at the most I can read entries until "now" (which by the way is also an accepted string). I don't understand what the use is of displaying journal entries about "tomorrow", which in my mind seems indeed useless as well?

Some examples or use cases for which the use of "tomorrow" was intended would be helpful, either imaginary or real.
 
Old 08-21-2018, 07:34 AM   #6
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 21,864

Rep: Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311Reputation: 7311
the only thing I can imagine is when the time is out of sync, so the log contains lines from the future (comparing to the actual/current date of the local host).

Probably journalctl contains the same/similar logic as the command date, so the same strings/syntax is recognized.
 
Old 08-21-2018, 07:46 AM   #7
twan163
LQ Newbie
 
Registered: Aug 2018
Posts: 4

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by pan64 View Post
the only thing I can imagine is when the time is out of sync, so the log contains lines from the future (comparing to the actual/current date of the local host).

Probably journalctl contains the same/similar logic as the command date, so the same strings/syntax is recognized.
That seems a reasonable explanation. Continuing your chain of thought, then it could be that the logs are exported to a central server, where logs from different time zones are collected. In that case the use of "tomorrow" would be acceptable..
I have no experience with central collection of logs, so this is pure conjecture.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Journalctl. What kind of journald setting is more correct? alekseev Linux - Server 21 07-23-2018 06:04 AM
openSuSE 13.2: journalctl -b unveils startup error André7785 SUSE / openSUSE 5 02-08-2018 05:09 PM
systemd journalctl cannot see dhcp client ip requests mgumbau Linux - Server 1 09-13-2017 04:03 AM
Monitoring login and su messages using journalctl fanoflq Linux - Newbie 2 02-17-2017 08:01 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 02:50 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration