The old syslogd used to provide useful information about USB devices as they were plugged in, particularly the /dev entry being created, A terminal window running tail -f /var/log/messages would show these.
With systemd, watchingjournalctl -fdoesn’t show the events. Running udevadm monitor does. The openSUSE reference book says:
When systemd replaced traditional init scripts in SUSE Linux Enterprise 12 (see Chapter 10, The systemd Daemon), it introduced its own logging system called journal. There is no need to run a syslog based service anymore, as all system events are written in the journal.
Is there any to make journalctl report these udev events?
Thanks. Was going to try that but did another hour of searching/reading, including this worrisome post
journalctl (actually “the journal”) supposedly is a higher level log that is supposed to include everything that is in /var/log/messages,
So maybe rsyslog/syslog-ng/syslogd wouldn’t help because they can’t forward info that isn’t in journalctl in the first place.
Anyway, I stumbled onto the solution to my “user error” problem: I had been running journalctl from a shell under my own user ID. (When I first started using journalctl I thought, “How nice! I don’t have to su/sudo to use journalctl like I always had to withsu -c 'tail -f /var/log/messages'”)
Problem is, journalctl only reports my own, user-specific, events if run this way. If run from a root shell, it does report udev events and info, and I can see what /dev/sd<disk><partition> entry was created when a USB drive is plugged in.
Sorry for the wasted thread. I promise to never say anything else bad about journalctl vs syslogd, systemd vs init, or iproute2 vs net-tools …
Adding “–ctime” is nice, too. (Thank you, “–help” text.)