How to view journalctl logs by unit and identifier with one command

systemdsystemd-journaldsystemd-unit

I have a vpn service unit for which I can view the logs with…

journalctl -u vpn

I also have a script that interacts with the vpn manually and is logged to journal with…

exec > >(systemd-cat -t vpn.sh) 2>&1

and I can view the logs with…

journalctl -t vpn.sh

I tried viewing both logs with…

journalctl -u vpn -t vpn.sh

but it didn't work.

Is there a way to view both logs at the same time? Or is it possible to set the identifier (-t vpn.sh) in the vpn service unit file to match the identifier of my script (vpn.sh).

Best Answer

TL;DR: This will work:

$ journalctl _SYSTEMD_UNIT=vpn.service + SYSLOG_IDENTIFIER=vpn.sh

You can use + to connect two sets of connections and look for journal log lines that match either expression. (This is documented in the man page of journalctl.)

In order to do that, you need to refer to them by their proper field names (the flags -u and -t are shortcuts for those.)

You can look at systemd.journal-fields(5) for the documentation of the field names. (That page will also explain why one of them has a leading underscore and the other one doesn't.)

For _SYSTEMD_UNIT you will need an exact match, including the .service suffix (the -u shortcut is smart and will find the exact unit name when translating it to a query by field.)

Putting it all together, you'll get the command above.

Related Question