1. Using the Cockpit Web Console
  2. Common Host Administration Tasks
  3. System Monitoring Actions
  4. View and Filter Log Entries

View and Filter Log Entries

The Logs page in Cockpit web console identify events and messages generated by the kernel, applications, and users signed in to the system. Cockpit administrators can exclude or include log entries appearing on the page by using predefined filter options or a free-form text search. In addition to the log filtering options, Cockpit administrators can also pause and resume the on-going reporting of log entries appearing on the Logs page as needed.

What Do You Need?

Steps

Using the Cockpit web console, follow these steps to manage the event and messages appearing on the Logs page.

  1. In the Cockpit navigation pane, click Logs.

    The Logs page appears displaying a listing of logged events.

    Note:

    On this page, the text field, by default, contains a text string expression that filters the list of displayed events. To see all the logged events, clear the text field of the filter.
  2. Perform any of the following tasks on the Logs page. You might need to clear the filter to see all the logged events.
    • View event details: In the list, click an event to access further details about that event. A journal page appears listing the details about the event, such as the priority level, syslog facility, syslog identifier, and the audit login UID and session.
    • Pause or resume the log view: Click Pause to stop new log entries from appearing on the page. Click Resume to display all on-going log entries, including the entries that were paused earlier from displaying.
    • Change log view with predefined filter options: Filter the log view by using the following predefined filters options:
      Filter Options
      Time Select a relative time period for the events you want to display in the log view. For example:

      • Current boot

      • Previous boot

      • Last 24 hours (default)

      • Last 7 days
      Priority Select a priority level for the events that you want to display in log view. For example:

      • Only emergency

      • Alert and above

      • Critical and above

      • Error and above (default)

      • Warning and above

      • Notice and above

      • Info and above

      • Debug and above

      Note:

      The Debug and above option displays the most expansive list of events.
      Identifier Select a syslog identifier for the type of events you want to include in the log view. For example:

      • All (default)

      • cockpit-session

      • kernel

      • password

      • sshd

      • sudo

      • systemd

      Note:

      The syslog identifier options correspond to the journalctl --identifier options.
    • Change log view with free-form search expression:
      1. Click the down-arrow in the text field to apply extra qualifiers to the search, or to create a free-form search expression.
        Search Parameters Description
        Since and Until Use the following date specification format to filter log entries by a specific date or time.
        • YYYY-MM-DD HH:MM:SS
        Or, you can:
        • Apply the following search strings: now, today, tomorrow, and yesterday.
        • Express relative times by prefixing "-" or "+" to the search string.
        Boot By default, when a boot ID is omitted the logs for the current boot appear. To display logs from a specific boot, specify a boot ID, for example:
        • boot=[ID]

          Where ID equals the boot order number (1, 2, and so on) found in the journal.

        Unit Filter log entries by a systemd unit (such as a service unit), or for units matching a specific pattern, for example:
        • unit=UNIT|PATTERN

        Note that when a pattern is specified, a list of unit names in the journal are compared with the specified pattern to display a list of all units matching the specified pattern.

        Free-form search Filter log entries by entering:
        • Any text string

          OR

        • A search string expression, for example: priority:err identifier:kernel

        Important:

        Each search parameter corresponds to a journalctl command parameter.
      2. Click Search to apply the search parameters to the log view; or, click Reset to clear the search fields.