journalctl

• journalctl -u sshd

  • show only log for sshd

• logger hello

  • write in syslog

• journalctl -f

  • log is live

• nano /etc/systemd/journald.conf

  • Storage=auto

• mkdir /var/log/journal

  • [unclear note in image]