Where is syslog?

[effy-coding]

I want to see syslog of Bottlerocket OS but /var/log/messages and /var/log/syslog don't exist. Also doesn't have rsyslog binary. Where can i get Bottlerocket's syslogs?

[bcressey]

All of the host logs are stored in the journal, under /var/log/journal.

[effy-coding]

Thanks @bcressey but i want to see syslog by facility codes (Example below). /var/log/journal looks like only storing systemd service logs not security messages, kernel messages, sshd messages. Can i get them?

0: kernel messages
1: user-level messages
2: mail system
3: system daemons
4: security/authorization messages
5: messages generated internally by syslog
6: line printer subsystem
7: network news subsystem
8: UUCP subsystem
9: clock daemon
10: security/authorization messages
11: FTP daemon
12: NTP subsystem
13: log audit
14: log alert
15: clock daemon

[arnaldo2792]

Hello @dangen-effy , you can filter out the logs you want by passing different flags to journalctl, at least for the following logs:

1. kernel messages: journalctl -k
2. system daemons: this is just the output of the usual journalctl command, you can filter down by service with -u
3. security/authorization messages: do you mean authorizations of ssh connections? There isn't any interactive "login" capability in Bottlerocket, only through the Admin container and it is disabled by default.
4. clock daemon: journalctl -u chronyd.service
5. FTP daemon: there isn't an FTP server running in Bottlerocket

I have a few questions about these logs:

1. user-level messages: do you mean user activity/commands executed by a user? If so, the only interactive way to have a human running commands is via host containers, but we don't log every single command executed in them. However, you can still get some logs out of the ssh server in the admin container (if enabled) via journalctl -u [email protected].
2. mail system: Bottlerocket doesn't provide a mail server
3. messages generated internally by syslog: do you mean syslog the daemon/application? If so, Bottlerocket doesn't run it

I'm not familiar with the following logs, probably @jpculp can help here:

1. line printer subsystem:
2. network news subsystem
3. UUCP subsystem
4. NTP subsystem

[begemotik]

I'm trying to debug bootstrap container and I can't find /var/log/journal file, journalctl returns No journal files were found.

What might be the reason of that?

[arnaldo2792]

Hello @begemotik , the logs generated by a bootstrap container will be available in the host's root filesystem, at /var/log/journal. You can access them from sheltie via the admin container:

# In the admin container
sheltie journalctl  -u bootstrap-containers@<name>.service

[begemotik]

Indeed, that works. Thank you!

[yaroslav-nakonechnikov]

it can be read from fs with knowing id. or without.
like

journalctl --file /.bottlerocket/rootfs/var/log/ <id>/sytem.journal

but... how this ui being populated? is there anything, which can answer it everytime?

upd.
found 2 ways to do what i need:

• cat /.bottlerocket/rootfs/etc/machine-id
• $(echo /.bottlerocket/rootfs/var/log/journal/*) -> it will put correct path if there only one subdirectory.

[jagadeeshvarma27]

I want to see syslog of Bottlerocket OS but /var/log/messages and /var/log/syslog don't exist. Also doesn't have rsyslog binary. Where can i get Bottlerocket's syslogs?

But ,there are no journal file in my server?