Logs and scheduling: journald, rsyslog, cron and timers

In short: Linux writes messages from the kernel and services into logs (journald, rsyslog, files under /var/log). Recurring tasks are started by cron or a systemd timer.

In more detail: When there are problems the log is the first stop: what did the service report last?

In detail

journalctl -b               # since the last boot
journalctl -u nginx -f      # follow a service live
journalctl -p err -b        # errors only
journalctl --since "1 hour ago"
dmesg -T | tail             # kernel messages
crontab -e                  # own schedules

• Cron line: */15 * * * * /path/script.sh = every 15 minutes. Fields: minute, hour, day, month, weekday.
• systemd timer: .timer plus .service, advantages: log in the journal, “catch up” after downtime (Persistent=true), dependencies. systemctl list-timers.
• Log files: /var/log/syslog, /var/log/auth.log (logins), /var/log/nginx/.
• Logrotate: rotates and deletes old logs so the disk does not fill up.
• Journal size: journalctl --vacuum-size=500M.
• Central: Loki, ELK/OpenSearch, Graylog with many servers.

See also: systemd and init systems, Kernel panic and oops