journalctl -f                               # follow
journalctl -u SERVICE -f                    # follow one unit
journalctl -b -1 -p err                     # errors from previous boot
journalctl --since "1 hour ago" -p warning  # recent warnings
journalctl -k                               # kernel
journalctl -t TAG                           # by syslog identifier
journalctl -g 'regex'                       # grep messages
journalctl -o json-pretty -n 1              # structured view
journalctl -F _SYSTEMD_UNIT                 # list units that logged
journalctl --disk-usage
sudo journalctl --vacuum-time=30d

sudo rsyslogd -N1                           # validate config
sudo systemctl restart rsyslog
journalctl -u rsyslog -n 50                 # rsyslog's own errors
logger -p FACILITY.LEVEL -t TAG "message"   # test routing

sudo logrotate -d /etc/logrotate.conf       # dry run, everything
sudo logrotate -d /etc/logrotate.d/APP      # dry run, one config
sudo logrotate -vf /etc/logrotate.d/APP     # force now
systemctl list-timers logrotate.timer

dmesg -T -l err,warn
dmesg -w
journalctl -k -b -1
echo "<4>test: message" | sudo tee /dev/kmsg

last -F -n 20
sudo lastb -n 20
sudo ausearch -k KEY -i
sudo aureport --auth --failed