Dive into Linux system logs in 3 easy steps

With our new Linux Journald Integration, you can look deep into your Linux systems easier than ever:

• Install Logagent
• Run logagent-setup
• Open your Sematext Logs app and start exploring:

The overview dashboard listed above gives you a general breakdown of your logs: by host, by severity, by Systemd unit, and so on. If you want to dig deeper into a specific topic, you can select one of the other dashboards (and, of course, you can create your own). For example, the Auth dashboard shows more security-related information, such as the latest sudo commands:

Other built-in dashboards include:

• Kernel: Logs filtered by the facility 0 (kernel). Here you will find all your startup logs, information about crashes, all that you typically see via dmesg
• SSH: Logs generated by the SSH daemon.
• Services: Logs from systemd saying starting/started/stopping/stopped. Look here for unexpected service restarts, for example.
• Startup&Shutdown: Logs from the system-shutdown service, as well as the kernel message telling you the Linux version on startup. Look here for reboots.
• Audit: Logs from the auditd service, with a syslog tag of audit and kernel messages including selinux or audit
• Cron: Logs sent to the cron facility (9). For example, you shell see here if logrotate ran properly.
• YUM/Snap: Logs labeled with either yum or snapd syslog tag. Look here for more info on package management.
• Mail: Logs sent to the mail facility (2). You can check on your postfix here.
• DNS: Messages from the systemd-resolved service. Look here if you suspect DNS resolution issues.