[SOLVED] example or use case for journalctl and tomorrow
Linux - ServerThis forum is for the discussion of Linux Software used in a server related context.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
While studying for the RHCSA exam, I was doing research in the man page for journalctl. I understand the use of "--since" and "--until", in combination with the strings "yesterday" or "today". But I can't imagine a case in which I could use the "tomorrow" string, like in
Code:
journalctl --since today --until tomorrow
What's the use of "tomorrow", if the moment I am looking at the logs, there won't be any log entries for "tomorrow"?
I there anyone who can provide an example or a use case? It would be much appreciated.
That would show all of today's messages without having to specify an exact end time for "today".
That is to say if you were checking at 10 AM you would only have message up to 10 AM. If you were checking at 7 PM you'd have more messages up through 7 PM. Rather than having to specify 10 AM or 7 PM if you specify "tomorrow" it will find all matching records which at 10 AM "today" would only be those to 10 AM but at 7 PM "today" would be those to 7 PM. This way you can always specify the same syntax to get "today" messages no matter what time "today" you are running the command.
That would show all of today's messages without having to specify an exact end time for "today".
That is to say if you were checking at 10 AM you would only have message up to 10 AM. If you were checking at 7 PM you'd have more messages up through 7 PM. Rather than having to specify 10 AM or 7 PM if you specify "tomorrow" it will find all matching records which at 10 AM "today" would only be those to 10 AM but at 7 PM "today" would be those to 7 PM. This way you can always specify the same syntax to get "today" messages no matter what time "today" you are running the command.
I think I understand what you are saying, unless I am missing something in your reply. But in that case I would rather use the command
Code:
journalctl --since today
Without "--until", as this seems to always give me the most recent journal entries, with "today" starting at "00:00:00".
--until tomorrow is probably useless, but syntactically correct.
where is this example coming from?
I have found mention of "tomorrow" in the man page for "journalctl". Under the options "--since" and "--until".
Quote:
-S, --since=, -U, --until=
Start showing entries on or newer than the specified date, or on or
older than the specified date, respectively. Date specifications
should be of the format "2012-10-30 18:17:16". If the time part is
omitted, "00:00:00" is assumed. If only the seconds component is
omitted, ":00" is assumed. If the date component is omitted, the
current day is assumed. Alternatively the strings "yesterday",
"today", "tomorrow" are understood, which refer to 00:00:00 of the
day before the current day, the current day, or the day after the
current day, respectively. "now" refers to the current time.
Finally, relative times may be specified, prefixed with "-" or "+",
referring to times before or after the current time, respectively.
For complete time and date specification, see systemd.time(7).
The use of "--since tomorrow" seems nonsense to me. So I assume the only logical place to use "tomorrow", would be with "--until".
What I can't wrap my head around is that the moment I use journalctl, at the most I can read entries until "now" (which by the way is also an accepted string). I don't understand what the use is of displaying journal entries about "tomorrow", which in my mind seems indeed useless as well?
Some examples or use cases for which the use of "tomorrow" was intended would be helpful, either imaginary or real.
the only thing I can imagine is when the time is out of sync, so the log contains lines from the future (comparing to the actual/current date of the local host).
Probably journalctl contains the same/similar logic as the command date, so the same strings/syntax is recognized.
the only thing I can imagine is when the time is out of sync, so the log contains lines from the future (comparing to the actual/current date of the local host).
Probably journalctl contains the same/similar logic as the command date, so the same strings/syntax is recognized.
That seems a reasonable explanation. Continuing your chain of thought, then it could be that the logs are exported to a central server, where logs from different time zones are collected. In that case the use of "tomorrow" would be acceptable..
I have no experience with central collection of logs, so this is pure conjecture.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.