See USB plug/unplug in journalctl?

The old syslogd used to provide useful information about USB devices as they were plugged in, particularly the /dev entry being created, A terminal window running tail -f /var/log/messages would show these.

With systemd, watchingjournalctl -fdoesn’t show the events. Running udevadm monitor does. The openSUSE reference book says:

When systemd replaced traditional init scripts in SUSE Linux Enterprise 12 (see Chapter 10, The systemd Daemon), it introduced its own logging system called journal. There is no need to run a syslog based service anymore, as all system events are written in the journal.

Is there any to make journalctl report these udev events?

You can still install “rsyslog” and get the old syslog files back.

Thanks. Was going to try that but did another hour of searching/reading, including this worrisome post

journalctl (actually “the journal”) supposedly is a higher level log that is supposed to include everything that is in /var/log/messages,

So maybe rsyslog/syslog-ng/syslogd wouldn’t help because they can’t forward info that isn’t in journalctl in the first place.

Anyway, I stumbled onto the solution to my “user error” problem: I had been running journalctl from a shell under my own user ID. (When I first started using journalctl I thought, “How nice! I don’t have to su/sudo to use journalctl like I always had to withsu -c 'tail -f /var/log/messages'”)

Problem is, journalctl only reports my own, user-specific, events if run this way. If run from a root shell, it does report udev events and info, and I can see what /dev/sd<disk><partition> entry was created when a USB drive is plugged in.

Sorry for the wasted thread. I promise to never say anything else bad about journalctl vs syslogd, systemd vs init, or iproute2 vs net-tools …

… for at least the next 24 hours. :wink:

Don’t worry. You observation and particulary you showing it here (thank you) may help others in understandinng the trickery of the new logging.

You can also use

dmesg --follow

as regular user.

Thanks! Tried it and it works for me. Very colorful! :slight_smile: Adding “–ctime” is nice, too. (Thank you, “–help” text.)

Can never have too many system-monitoring and/or -administrating tools.

That is only a short reminder of the command’s structure. You should of course at least consult

man dmesg

before you start using it. Like you consult the man page of every “new to you” command before using it.