| # | Command | Purpose |
|---|---|---|
| 1 | journalctl | Show all logs |
| 2 | journalctl --no-pager | Show all logs without paging (less) |
| 3 | journalctl -b | Show logs from current boot |
| 4 | journalctl -b -1 | Show logs from previous boot |
| 5 | journalctl -f | Follow logs in real time (similar to tail -f) |
| 6 | journalctl -u <service> | Show logs for a specific service |
| 7 | journalctl -u <service> -f | Follow a service's logs in real time |
| 8 | journalctl -p err | Show only error logs |
| 9 | journalctl -p warning..emerg | Show warnings, errors, critical, and emergency logs |
| 10 | journalctl --since "1 hour ago" | Show logs from the last hour |
| 11 | journalctl --since "YYYY-MM-DD HH:MM" --until "YYYY-MM-DD HH:MM" | Show logs within a time range |
| 12 | journalctl -k | Show kernel logs only |
| 13 | journalctl _PID=1234 | Show logs for a specific process ID |
| 14 | journalctl _COMM=sshd | Show logs for a specific command/process |
| 15 | journalctl -n 50 | Show last 50 log entries |
| 16 | journalctl --disk-usage | Show journal log disk usage |
| 17 | sudo journalctl --vacuum-time=7d | Delete logs older than 7 days |
| 18 | sudo journalctl --vacuum-size=500M | Reduce journal size to 500 MB |
| Scenario | Command |
|---|---|
| Check failed service | journalctl -u myservice -p err --since today |
| Monitor service live | journalctl -u myservice -f |
| Investigate reboot issues | journalctl -b -1 |
| Check kernel warnings | journalctl -k -p warning |
| View logs for last 30 minutes | journalctl --since "30 min ago" |
| Check SSH issues | journalctl -u sshd |
| Check Docker service logs | journalctl -u docker -f |
| View logs between timestamps | journalctl --since "2026-09-02 10:00" --until "2026-09-02 11:00" |
| View logs without pager | journalctl --no-pager |
| Find log storage usage | journalctl --disk-usage |
# Find or remove files older than 30 days$ find . -mtime +30 | xargs rm$ find . -type f -mtime +30 -delete$ find /logs/ -mtime +30 -exec rm {} \;# Finding the files of specific size$ find . -xdev -size +100000000c -exec ls -lrt {} \; // 100MB$ find . -xdev -size +10000000c -exec ls -lrt {} \; //10 MB$ find . -xdev -size +1000000c -exec ls -lrt {} \;$ find . -size +100000000c$ du -sk * | sort -n# Removing specific files$ rm `ls -rtl |grep Aug |awk '{print $9}'`$ rm `ls -rtl |grep 2009 |awk '{print $9}'`# Check file permissions$ find . \! -perm 750 -exec ls -ldb {} \;# Check file ownership$ cat /etc/passwd grep 533# Find string into a FS$ grep -rnw . -e "searchString"# Replace string in vi-editor$ %s/string1/string2/g# Replace a string in nested FS$ find . -type f xargs perl -pi -e 's;abc;xyz;g'$ find . -name '*.xml' -o -name '*.conf' -o -name '*.properties' -o -name '*.sh' | xargs perl -pi -e 's?abc?xyz?g'# Clear cache of server$ sync;sync echo3 >/proc/sys/vm/drop_cache# Check last login details$ last | grep Mon | awk '{print $1}' | sort -u# Temporarily increasing the mount size$ mount -o remount,size=2G /tmp/# Add user in Linux$ useradd -u 920 -g usrgrp -d /home/punit -m -s /bin/ksh punit ;echo "password" | /usr/bin/passwd --stdin punit# Add password-less user in Linux$ useradd punit -g usrgrp -s /usr/sbin/nologin -f -1 -c "App user for APP-TESTING" -K PASS_MAX_DAYS=-1# Add user as sudo user$ vi /etc/sudoers$ username ALL=(ALL) NOPASSWD:ALL# Fetch IP to put in a shell script$ `ip addr list|grep "inet " |cut -d' ' -f6|cut -d/ -f1|grep -v "127.0.0.1"`
$ `/sbin/ifconfig -a | grep "inet addr" | awk '{print $2}' | grep -v "127.0.0.1"
PRODUCT-SPECIFIC COMMANDS
CHECK PRODUCTS INSTALLED ON A UNIX SERVER
UNIX/LINUX/AIX/HP-UX$ df -P 2>/dev/null | grep "^/" | grep -v "/proc" | awk '{if ($1!~/:/){print "find " $NF " -xdev -name versionInfo.sh -o -name weblogic.jar -o -name catalina.jar -o -name webservd -o -name httpd -o -name jboss-management.jar -o -name domian.xml -o -name standalone.xml -o -name Agent.jar -o -name LLAWP -o -name server.cnf"}}' | sh | grep -v "^/var/tmp" | grep -v "^/tmp"SOLARIS$ df -l | grep "^/" | grep -v "/proc" | nawk -F "(" '{print "find " $1 " -xdev -name versionInfo.sh -o -name weblogic.jar -o -name catalina.jar -o -name webservd -o -name httpd -o -name jboss-management.jar -o -name domian.xml -o -name standalone.xml -o -name Agent.jar -o -name LLAWP -o -name server.cnf"}' | sh | grep -v"^/var/tmp" | grep -v "^/tmp"