docs: add a few examples how to query Netdata logs using journalctl (#16650)
Ilya Mashchenko committed
Dec 21, 2023 at 15:55 UTC
91989d191c1c933d1a46206ca74c6eec5e908d70
1 file changed
+18
-1
libnetdata/log/README.md
+18
-1
@@ -114,7 +114,8 @@ Sending a `SIGHUP` to Netdata, will instruct it to re-open all its log files.
114
115
## Log Fields
116
117
-Netdata exposes the following fields to its logs:
117
+<details>
118
+<summary>All fields exposed by Netdata</summary>
119
120
| journal | logfmt | json | Description |
121
|:--------------------------------------:|:------------------------------:|:------------------------------:|:---------------------------------------------------------------------------------------------------------:|
@@ -177,6 +178,7 @@ Netdata exposes the following fields to its logs:
178
| `ND_REQUEST` | `request` | `request` | the full request during which the event happened |
179
| `MESSAGE` | `msg` | `msg` | the event message |
180
181
+</details>
182
183
### Message IDs
184
@@ -204,3 +206,18 @@ journalctl MESSAGE_ID=9ce0cb58ab8b44df82c4bf1ad9ee22de
206
journalctl MESSAGE_ID=6db0018e83e34320ae2a659d78019fb7
207
```
208
209
+## Using journalctl to query Netdata logs
210
+
211
+The Netdata service's processes execute within the `netdata` journal namespace. To view the Netdata logs, you should
212
+specify the `--namespace=netdata` option.
213
+
214
+```bash
215
+# Netdata logs since the last time the service was started
216
+journalctl _SYSTEMD_INVOCATION_ID="$(systemctl show --value --property=InvocationID netdata)" --namespace=netdata
217
+
218
+# All netdata logs, the oldest entries are displayed first
219
+journalctl -u netdata --namespace=netdata
220
+
221
+# All netdata logs, the newest entries are displayed first
222
+journalctl -u netdata --namespace=netdata -r
223
+```