Linux Security

Introduction to Log Rotation with systemd

I’ve seen log files consume all available disk space, bringing systems to a grinding halt. That’s why log rotation is a crucial aspect of system administration. With systemd becoming a de facto standard for managing system services and logs on many Linux distributions, I’ll explore how to use it to manage and rotate log files efficiently.

Understanding systemd-journald

systemd-journald is the system service that collects and stores log messages from various sources, including system services, kernel messages, and user applications. By default, journald stores log messages in a binary format, which can be queried using the journalctl command. To manage log rotation, we need to understand how journald handles log storage and rotation. Don’t bother with manually rotating log files - journald can handle it for you.

Introduction to systemd-resolved

I’ve seen systemd-resolved cause some headaches in multi-network setups, so it’s worth understanding how it works. As part of the systemd suite, systemd-resolved is a DNS resolver that’s enabled by default on many modern Linux distributions, including Ubuntu and Fedora. The real trick is configuring it to avoid DNS surprises.

Configuring systemd-resolved

To get systemd-resolved working the way you want, you need to know how it uses DNS servers. It combines the DNS servers provided by your system’s network configuration with those specified in the /etc/systemd/resolved.conf file. Don’t bother with the network configuration; just modify the resolved.conf file to specify your preferred DNS servers. For example, to use Google’s public DNS servers, add the following lines to the [Resolve] section:

Introduction to Log Noise

I’ve seen log noise become a significant headache for Linux administrators, making it tough to identify important events and errors in system logs. With the sheer volume of data generated by modern systems, filtering out irrelevant information is crucial for efficient troubleshooting and maintenance. In this article, I’ll show you how to tame log noise using jq and systemd journal filters.

Understanding systemd Journal

The systemd journal is a centralized logging solution that collects and stores log messages from various system components. It’s a robust and efficient way to manage logs, allowing administrators to filter, prioritize, and analyze log data. The journal stores log messages in a binary format, which can be queried and filtered using the journalctl command. Don’t bother with trying to parse the binary format directly - it’s not worth the hassle.

Introduction to resolvectl

I’ve seen my fair share of DNS issues on Linux, and one tool that’s always helped me resolve them is resolvectl. This command-line utility, part of the systemd suite, provides a comprehensive way to query and configure DNS settings on your system. In this article, I’ll share some practical examples of how to use resolvectl to diagnose and fix stubborn DNS issues.

Understanding DNS Resolution

Before diving into resolvectl, it’s essential to understand how DNS resolution works on Linux. The DNS (Domain Name System) is responsible for translating human-readable domain names into IP addresses that computers can understand. On Linux systems, DNS resolution is typically handled by a resolver, which queries DNS servers to resolve domain names. The resolver configuration is usually defined in /etc/resolv.conf, but with systemd, resolvectl offers a more integrated and dynamic way to manage DNS settings.

Introduction to Find and Xargs

I’ve seen many Linux systems become cluttered over time, making it harder to manage packages and maintain security. That’s where find and xargs come in - two powerful command-line tools that can help you clean up your system. In this article, I’ll show you how to use these tools to safely remove unused packages on your Linux system.

Understanding Find and Xargs

The find command is incredibly versatile, allowing you to search for files based on various conditions like file name, size, modification time, and more. xargs, on the other hand, builds and executes command lines from standard input. By combining these two tools, you can automate the process of finding and removing unused packages. Don’t bother with manual searches - find and xargs can save you a lot of time and effort.

Debugging Local Networks with resolvectl and ss

When I’m dealing with local network issues, I always reach for two essential tools: resolvectl and ss. These utilities provide valuable insights into DNS resolution and network socket connections, making it easier to identify and troubleshoot common network problems.

resolvectl for DNS Troubleshooting

I’ve seen this go wrong when DNS resolution fails, and resolvectl is a lifesaver. This command-line utility lets you query and control the systemd-resolved service, which handles DNS resolution on many modern Linux distributions. With resolvectl, you can perform DNS lookups, check the status of DNS servers, and even override default DNS settings for troubleshooting purposes.

Introduction to SSH Connection Issues

I’ve seen my fair share of SSH connection issues over the years, especially when dealing with new servers or changes in network configurations. Secure Shell (SSH) is a fundamental tool for remote access and management in Linux, but issues with unknown hosts and missing host keys can be a real headache. Understanding how to troubleshoot and resolve these issues is crucial for efficient system administration and security.

Introduction to Systemd Service Restart Policies

Systemd is the backbone of most modern Linux distributions, and one of its key features is managing service restart policies. I’ve seen this go wrong when a service fails and takes down the entire system with it. In this article, we’ll dive into the world of systemd service restart policies and explore how to configure them to prevent cascading failures.

Understanding Systemd Service Restart Policies

Systemd provides several restart policies that can be applied to services. The real trick is understanding when to use each one:

Introduction to Log Noise

I’ve seen this go wrong when dealing with system logs - the sheer amount of unnecessary or redundant log messages can make it difficult to identify real issues. As a Linux administrator, managing log noise is essential for efficient system maintenance and troubleshooting. In this article, I’ll share how to tame log noise using jq and systemd journal filters.

Understanding systemd Journal

Systemd journal is a powerful centralized logging system that collects and stores log messages from various system components. It provides a robust and flexible way to manage logs, including filtering, prioritization, and storage. The real trick is to leverage the journalctl command to work with systemd journal.

Introduction to Journalctl

I’ve been working with Linux systems for years, and one tool that’s become essential to my workflow is journalctl. As of 2026, most modern Linux distributions have adopted systemd as their default init system, making journalctl a must-know tool for system administrators and users alike. In this article, I’ll share how to use journalctl to filter out unnecessary log noise and focus on meaningful errors.

Understanding Journalctl Basics

Before diving into advanced filtering techniques, let’s cover the basics of journalctl. The command journalctl can be used to view system logs, and by default, it will show you the most recent log entries. You can use the -n option to specify the number of log entries to display, for example, journalctl -n 10 will show you the last 10 log entries. Don’t bother with sudo unless you need to access system logs - journalctl will automatically use your current user’s permissions.