Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

此内容没有您所选择的语言版本。

Chapter 3. Reviewing and filtering logs in the web console

The Red Hat Enterprise Linux web console provides a graphical interface for accessing, reviewing, and filtering logs. You can use the most common functions without memorizing the corresponding commands and options.

3.1. Reviewing logs in the web console
复制链接

You can quickly access and examine system logs by using the RHEL web console’s dedicated Logs section. This graphical interface helps centralize log monitoring for various system functions across the host and provides a UI for the journalctl utility.

Prerequisites

Procedure

  1. Log in to the RHEL 10 web console.
  2. Click Logs.
  3. Open log entry details by clicking on your selected log entry in the list.

Next steps

  • After clicking Toggle filters to expand the menu, you can use the Pause button to pause new log entries from appearing. Once you resume new log entries, the web console loads all log entries that are reported after you use the Pause button.
  • You can filter the logs by time, priority, or identifier. For more information, see Reviewing and filtering logs in the web console.

3.2. Filtering logs in the web console
复制链接

You can filter system logs directly in the RHEL web console based on time range, priority, or specific identifiers. This capability helps administrators focus only on critical messages for targeted troubleshooting.

Prerequisites

Procedure

  1. Log in to the RHEL 10 web console.
  2. Click Logs.
  3. Click Toggle filters.
  4. To change the default log filtering, use the Time, Priority, and Identifier drop-down menus.

  5. Optional: By default, the web console shows the latest log entries. To filter by a specific time range, click the Expand button.

    Toggling the custom time range

  6. Click the → button (right pointing arrow) to apply your filters.
  7. To open a log entry, click the selected log entry.

With the text search syntax and options available in the RHEL web console, you can filter logs effectively. This enables high precision when searching for specific errors or keywords across extensive system logs.

The text search option functionality provides a wide variety of options for filtering logs. If you decide to filter logs by using the text search, you can use the predefined options that are defined in the three drop-down menus, or you can type the whole search yourself.

Drop-down menus

You can use three drop-down menus to specify the main parameters of your search:

  • Time: This drop-down menu contains predefined searches for different time ranges of your search.
  • Priority: This drop-down menu provides options for different priority levels. It corresponds to the journalctl --priority option. The default priority value is Error and above. It is set every time you do not specify any other priority.
  • Identifier: In this drop-down menu, you can select an identifier that you want to filter. Corresponds to the journalctl --identifier option.
Quantifiers
You can use six quantifiers to specify your search. They are covered in the Options for filtering logs table.
Log fields
To search for a specific log field, you can specify the field together with its content.
Free-form text search in log messages
You can filter any text string of your choice in the log messages. The string can also be in the form of a regular expression.

Example 3.1. Logs filtering based on time

Filter all log messages identified by 'systemd' that happened since October 22, 2020 midnight and journal field 'JOB_TYPE' is either 'start' or 'restart.

  1. Type identifier:systemd since:2020-10-22 JOB_TYPE=start,restart to search field.

  2. Check the results.

    Logs filtering based on time

Example 3.2. Logs containing error and fail messages

Filter all log messages that come from 'cockpit.service' systemd unit that happened in the boot before last and the message body contains either "error" or "fail".

  1. Type service:cockpit boot:-1 error|fail to the search field.

  2. Check the results.

    Logs containing error and fail messages

You can filter logs according to different parameters by using the text search box in the web console. The search combines the usage of the filtering drop-down menus, quantifiers, log fields, and free-form string search.

Prerequisites

Procedure

  1. Log in to the RHEL 10 web console.
  2. Click Logs.

  3. Use the drop-down menus to specify the three main quantifiers - time range, priority, and identifier(s) - you want to filter.

    The Priority quantifier must have a value. If you do not specify a value, it automatically filters the Error and above priority. The options you set reflect in the text search box.

  4. Specify the log field you want to filter.

    You can add several log fields.

  5. You can use a free-form string to search for anything else. The search box also accepts regular expressions.

3.5. Options for filtering logs
复制链接

Review the various options available for filtering system logs in the RHEL web console. Options include time range, priority, identifier, and customized text search fields.

You can use journalctl options for filtering logs in the web console. Some of these options are provided as parts of the drop-down menus in the web console interface.

Expand
Table 3.1. Options for filtering logs in the RHEL web console
Option nameUsageNotes

priority

Filters output by message priorities. Takes a single numeric or textual log level. The log levels are the usual syslog log levels. If a single log level is specified, all messages with this log level or a lower and more important log level are shown.

Covered in the Priority drop-down menu.

identifier

Shows messages for the specified syslog identifier SYSLOG_IDENTIFIER. Can be specified multiple times.

Covered in the Identifier drop-down menu.

follow

Shows only the most recent journal entries, and continuously prints new entries as they are appended to the journal.

Not covered in a drop-down.

service

Shows messages for the specified systemd unit. Can be specified multiple times.

Is not covered in a drop-down. Corresponds to the journalctl --unit parameter.

boot

Shows messages from a specific boot.

A positive integer looks up the boots starting from the beginning of the journal, and an equal-or-less-than-zero integer looks up boots starting from the end of the journal. Therefore, 1 means the first boot found in the journal in chronological order, 2 the second, and so on; while -0 is the last boot, -1 the boot before last, and so on.

Covered only as Current boot or Previous boot in the Time drop-down menu. You must specify other options manually.

since

Starts showing entries on or newer than the specified date, or on or older than the selected date. Date specifications should be of the format "2012-10-30 18:17:16". If the time part is omitted, "00:00:00" is considered. If only the seconds component is omitted, ":00" is assumed. If the date component is omitted, the current day is assumed. Alternatively, the strings "yesterday", "today", "tomorrow" are understood, which refer to 00:00:00 of the day before the current day, the current day, or the day after the current day. "now" refers to the current time. Finally, relative times might be specified, prefixed with "-" or "+", referring to times before or after the current time.

Not covered in a drop-down.

Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

Theme

© 2026 Red Hat返回顶部