[systemd-devel] Q: journalctl -b -g logrotate

[Ulrich Windl]

Hi!

I have two questions for "journalctl -b -g logrotate":

1) I'm unsure what the exact rules for matching a "-g expression" are: Some kernel messages are matched, others not.
2) When the -b restricts messages to the current boot, why is output shown like this?:
# journalctl -b -g logrotate
-- Logs begin at Wed 2020-11-25 11:27:53 CET, end at Tue 2022-04-05 08:01:02 CEST. --

I mean the boot was definitely in 2022, so I think the message is not really helpful. Why not show the date and time when the search starts (i.e. boot time)?

The next thing is "-k": If I supply it, kernel messages are _not_ found:
# journalctl -S 2022-04-02 -k | grep "OCFS2:" |head
# journalctl -S 2022-04-02 | grep "OCFS2:" |head
Apr 02 02:00:06 h18 kernel: OCFS2: ERROR (device dm-17): ocfs2_validate_gd_self: Group descriptor #209970 has bad signature EXBLK01
Apr 02 02:00:06 h18 kernel: OCFS2: File system is now read-only.
Apr 02 02:00:07 h18 kernel: OCFS2: ERROR (device dm-17): ocfs2_validate_gd_self: Group descriptor #209817 has bad signature EXBLK01
Apr 02 02:00:07 h18 kernel: OCFS2: ERROR (device dm-17): ocfs2_validate_gd_self: Group descriptor #209946 has bad signature EXBLK01

So can I find kernel messages from previous boots?

(systemd-246.16-150300.7.39.1.x86_64 of SLES15 SP3)

Regards,
Ulrich