{"id":1172,"date":"2026-07-18T10:39:06","date_gmt":"2026-07-18T07:39:06","guid":{"rendered":"https:\/\/itgen.itbumper.com\/?page_id=1172"},"modified":"2026-07-18T10:39:07","modified_gmt":"2026-07-18T07:39:07","slug":"0047_mobaxterm-macros-05-debian-logs-and-journal","status":"publish","type":"page","link":"https:\/\/itgen.itbumper.com\/?page_id=1172","title":{"rendered":"0047_MobaXterm macros: 05.Debian-Logs and Journal"},"content":{"rendered":"\n

5.1 Journal Status \/ Disk Usage (+ Available Boots & Storage Type)
5.2 Current Boot Errors (Journalctl -p err)
5.3 Current Boot Warnings (Journalctl -p warning)
5.4 Kernel Errors (dmesg & Journalctl -k)
5.5 Authentication Logs (SSH, Sudo & Auth Activity)
5.6 Recent Reboots \/ Shutdowns (+ Boot Time)
5.7 OOM Events (Out Of Memory Triggers)
5.8 Storage \/ Filesystem Errors (SCSI, NVMe, Ext4\/XFS faults)
5.9 Network Errors (Link Drops, NIC Resets & Watchdogs)
5.10 Service Failures (Detailed Daemon Crashes)
5.11 Log Rotation (Configs, Status & Timers)
5.12 Large Log Files (Top 20 Hunt)
5.13 Recently Modified Logs (Last 60 Minutes)<\/p>\n

Copy–>Past<\/strong><\/p>\n\n\n

\necho "==================== 05. LOGS & JOURNAL ===================="; printf "\\n"; echo "5.1 JOURNAL STATUS \/ DISK USAGE"; if command -v journalctl >\/dev\/null 2>&1; then echo "--- Journal Disk Usage ---"; journalctl --disk-usage 2>\/dev\/null || echo "Journal disk usage unavailable"; printf "\\n"; echo "--- Available Boots ---"; journalctl --list-boots --no-pager 2>\/dev\/null | tail -20 || echo "Boot journal history unavailable"; printf "\\n"; echo "--- Journal Storage ---"; if [ -d \/var\/log\/journal ]; then echo "Persistent journal storage: enabled"; du -sh \/var\/log\/journal 2>\/dev\/null; else echo "Persistent journal storage: not detected"; echo "Journal may be stored only in \/run\/log\/journal"; fi; else echo "journalctl not available"; fi; printf "\\n%.0s" {1..3}; echo "5.2 CURRENT BOOT ERRORS"; if command -v journalctl >\/dev\/null 2>&1; then journalctl -b 0 -p err --no-pager 2>\/dev\/null | tail -50; else echo "journalctl not available"; fi; printf "\\n%.0s" {1..3}; echo "5.3 CURRENT BOOT WARNINGS"; if command -v journalctl >\/dev\/null 2>&1; then journalctl -b 0 -p warning --no-pager 2>\/dev\/null | tail -50; else echo "journalctl not available"; fi; printf "\\n%.0s" {1..3}; echo "5.4 KERNEL ERRORS"; echo "--- dmesg Critical Errors ---"; if command -v dmesg >\/dev\/null 2>&1; then dmesg -T --level=err,crit,alert,emerg 2>\/dev\/null | tail -40 || echo "dmesg unavailable or access restricted"; else echo "dmesg not available"; fi; printf "\\n"; echo "--- Kernel Journal Errors ---"; if command -v journalctl >\/dev\/null 2>&1; then journalctl -k -b 0 -p err --no-pager 2>\/dev\/null | tail -40; else echo "journalctl not available"; fi; printf "\\n%.0s" {1..3}; echo "5.5 AUTHENTICATION LOGS"; echo "--- Recent SSH \/ Sudo Activity ---"; if command -v journalctl >\/dev\/null 2>&1; then journalctl -b 0 --no-pager 2>\/dev\/null | grep -Ei 'sshd|ssh.service|sudo|su:|authentication failure|failed password|accepted password|accepted publickey|invalid user' | tail -60 || echo "No recent SSH or sudo activity found"; else tail -n 100 \/var\/log\/auth.log \/var\/log\/secure 2>\/dev\/null | grep -Ei 'sshd|sudo|su:|authentication failure|failed password|accepted password|accepted publickey|invalid user' | tail -60 || echo "Authentication logs unavailable"; fi; printf "\\n%.0s" {1..3}; echo "5.6 RECENT REBOOTS \/ SHUTDOWNS"; echo "--- Reboots ---"; last reboot 2>\/dev\/null | head -20 || echo "Reboot history unavailable"; printf "\\n"; echo "--- Shutdowns ---"; last shutdown 2>\/dev\/null | head -20 || echo "Shutdown history unavailable"; printf "\\n"; echo "--- Current Boot Time ---"; who -b 2>\/dev\/null || echo "Current boot time unavailable"; printf "\\n%.0s" {1..3}; echo "5.7 OOM EVENTS"; if command -v journalctl >\/dev\/null 2>&1; then journalctl -b 0 --no-pager 2>\/dev\/null | grep -Ei 'oom-killer|out of memory|killed process [0-9]+|memory cgroup out of memory|invoked oom-killer' | tail -40 || echo "No OOM events found in current boot"; else grep -Eih 'oom-killer|out of memory|killed process [0-9]+|memory cgroup out of memory|invoked oom-killer' \/var\/log\/messages \/var\/log\/syslog 2>\/dev\/null | tail -40 || echo "No OOM events found"; fi; printf "\\n%.0s" {1..3}; echo "5.8 STORAGE \/ FILESYSTEM ERRORS"; if command -v journalctl >\/dev\/null 2>&1; then journalctl -k -b 0 --no-pager 2>\/dev\/null | grep -Ei 'I\/O error|buffer I\/O|blk_update_request|critical medium error|uncorrectable|sense key|resetting link|device offline|EXT4-fs error|XFS.*error|BTRFS.*error|ZFS.*error|read-only file system|remounting filesystem read-only|bad sector|ata[0-9].*error|nvme.*error' | tail -60 || echo "No storage or filesystem errors found"; else dmesg 2>\/dev\/null | grep -Ei 'I\/O error|buffer I\/O|blk_update_request|critical medium error|uncorrectable|sense key|resetting link|device offline|EXT4-fs error|XFS.*error|BTRFS.*error|ZFS.*error|read-only file system|remounting filesystem read-only|bad sector|ata[0-9].*error|nvme.*error' | tail -60 || echo "No storage or filesystem errors found"; fi; printf "\\n%.0s" {1..3}; echo "5.9 NETWORK ERRORS"; if command -v journalctl >\/dev\/null 2>&1; then journalctl -k -b 0 --no-pager 2>\/dev\/null | grep -Ei 'link is down|link down|link becomes ready|lost carrier|no carrier|carrier lost|NETDEV WATCHDOG|transmit queue timed out|tx timeout|NIC Link is Down|renamed from|reset adapter|firmware failed|network.*error' | tail -60 || echo "No network link or adapter errors found"; else dmesg 2>\/dev\/null | grep -Ei 'link is down|link down|link becomes ready|lost carrier|no carrier|carrier lost|NETDEV WATCHDOG|transmit queue timed out|tx timeout|NIC Link is Down|renamed from|reset adapter|firmware failed|network.*error' | tail -60 || echo "No network link or adapter errors found"; fi; printf "\\n%.0s" {1..3}; echo "5.10 SERVICE FAILURES"; if command -v journalctl >\/dev\/null 2>&1; then journalctl -b 0 --no-pager 2>\/dev\/null | grep -Ei 'failed to start|failed with result|main process exited|control process exited|start request repeated too quickly|scheduled restart job|dependency failed for|entered failed state' | tail -60 || echo "No service failure events found"; else echo "journalctl not available"; fi; printf "\\n%.0s" {1..3}; echo "5.11 LOG ROTATION"; echo "--- Logrotate Package \/ Binary ---"; if command -v logrotate >\/dev\/null 2>&1; then logrotate --version 2>\/dev\/null | head -1; else echo "logrotate not installed"; fi; printf "\\n"; echo "--- Logrotate Configuration ---"; ls -la \/etc\/logrotate.conf \/etc\/logrotate.d\/ 2>\/dev\/null || echo "Logrotate configuration unavailable"; printf "\\n"; echo "--- Logrotate Status ---"; ls -la \/var\/lib\/logrotate\/status \/var\/log\/logrotate \/var\/log\/logrotate.log 2>\/dev\/null || echo "Logrotate status file or execution log unavailable"; printf "\\n"; echo "--- Logrotate Timer \/ Service ---"; systemctl status logrotate.timer logrotate.service --no-pager 2>\/dev\/null | head -40 || echo "Logrotate systemd units unavailable"; printf "\\n%.0s" {1..3}; echo "5.12 LARGE LOG FILES"; find \/var\/log -xdev -type f -printf '%s %p\\n' 2>\/dev\/null | sort -nr | head -20 | awk '{ size=$1; $1=""; printf "%10.2f MiB %s\\n", size\/1024\/1024, substr($0,2) }' || echo "Unable to inspect \/var\/log"; printf "\\n%.0s" {1..3}; echo "5.13 RECENTLY MODIFIED LOGS"; find \/var\/log -xdev -type f -mmin -60 -printf '%TY-%Tm-%Td %TH:%TM:%TS %p\\n' 2>\/dev\/null | sort -r | head -40 || echo "No logs modified during the last hour"\n<\/pre><\/div>\n\n
\n# ==================== 05. LOGS & JOURNAL ====================\necho "==================== 05. LOGS & JOURNAL ===================="\nprintf "\\n"\n\n# --- 5.1 JOURNAL STATUS \/ DISK USAGE ---\necho "5.1 JOURNAL STATUS \/ DISK USAGE"\nif command -v journalctl >\/dev\/null 2>&1; then\n    echo "--- Journal Disk Usage ---"\n    journalctl --disk-usage 2>\/dev\/null || echo "Journal disk usage unavailable"\n    printf "\\n"\n    echo "--- Available Boots ---"\n    journalctl --list-boots --no-pager 2>\/dev\/null | tail -20 || echo "Boot journal history unavailable"\n    printf "\\n"\n    echo "--- Journal Storage ---"\n    if [ -d \/var\/log\/journal ]; then\n        echo "Persistent journal storage: enabled"\n        du -sh \/var\/log\/journal 2>\/dev\/null\n    else\n        echo "Persistent journal storage: not detected"\n        echo "Journal may be stored only in \/run\/log\/journal"\n    fi\nelse\n    echo "journalctl not available"\nfi\nprintf "\\n%.0s" {1..3}\n\n# --- 5.2 CURRENT BOOT ERRORS ---\necho "5.2 CURRENT BOOT ERRORS"\nif command -v journalctl >\/dev\/null 2>&1; then\n    journalctl -b 0 -p err --no-pager 2>\/dev\/null | tail -50\nelse\n    echo "journalctl not available"\nfi\nprintf "\\n%.0s" {1..3}\n\n# --- 5.3 CURRENT BOOT WARNINGS ---\necho "5.3 CURRENT BOOT WARNINGS"\nif command -v journalctl >\/dev\/null 2>&1; then\n    journalctl -b 0 -p warning --no-pager 2>\/dev\/null | tail -50\nelse\n    echo "journalctl not available"\nfi\nprintf "\\n%.0s" {1..3}\n\n# --- 5.4 KERNEL ERRORS ---\necho "5.4 KERNEL ERRORS"\necho "--- dmesg Critical Errors ---"\nif command -v dmesg >\/dev\/null 2>&1; then\n    dmesg -T --level=err,crit,alert,emerg 2>\/dev\/null | tail -40 || echo "dmesg unavailable or access restricted"\nelse\n    echo "dmesg not available"\nfi\nprintf "\\n"\necho "--- Kernel Journal Errors ---"\nif command -v journalctl >\/dev\/null 2>&1; then\n    journalctl -k -b 0 -p err --no-pager 2>\/dev\/null | tail -40\nelse\n    echo "journalctl not available"\nfi\nprintf "\\n%.0s" {1..3}\n\n# --- 5.5 AUTHENTICATION LOGS ---\necho "5.5 AUTHENTICATION LOGS"\necho "--- Recent SSH \/ Sudo Activity ---"\nif command -v journalctl >\/dev\/null 2>&1; then\n    journalctl -b 0 --no-pager 2>\/dev\/null | grep -Ei 'sshd|ssh.service|sudo|su:|authentication failure|failed password|accepted password|accepted publickey|invalid user' | tail -60 || echo "No recent SSH or sudo activity found"\nelse\n    tail -n 100 \/var\/log\/auth.log \/var\/log\/secure 2>\/dev\/null | grep -Ei 'sshd|sudo|su:|authentication failure|failed password|accepted password|accepted publickey|invalid user' | tail -60 || echo "Authentication logs unavailable"\nfi\nprintf "\\n%.0s" {1..3}\n\n# --- 5.6 RECENT REBOOTS \/ SHUTDOWNS ---\necho "5.6 RECENT REBOOTS \/ SHUTDOWNS"\necho "--- Reboots ---"\nlast reboot 2>\/dev\/null | head -20 || echo "Reboot history unavailable"\nprintf "\\n"\necho "--- Shutdowns ---"\nlast shutdown 2>\/dev\/null | head -20 || echo "Shutdown history unavailable"\nprintf "\\n"\necho "--- Current Boot Time ---"\nwho -b 2>\/dev\/null || echo "Current boot time unavailable"\nprintf "\\n%.0s" {1..3}\n\n# --- 5.7 OOM EVENTS ---\necho "5.7 OOM EVENTS"\nif command -v journalctl >\/dev\/null 2>&1; then\n    journalctl -b 0 --no-pager 2>\/dev\/null | grep -Ei 'oom-killer|out of memory|killed process [0-9]+|memory cgroup out of memory|invoked oom-killer' | tail -40 || echo "No OOM events found in current boot"\nelse\n    grep -Eih 'oom-killer|out of memory|killed process [0-9]+|memory cgroup out of memory|invoked oom-killer' \/var\/log\/messages \/var\/log\/syslog 2>\/dev\/null | tail -40 || echo "No OOM events found"\nfi\nprintf "\\n%.0s" {1..3}\n\n# --- 5.8 STORAGE \/ FILESYSTEM ERRORS ---\necho "5.8 STORAGE \/ FILESYSTEM ERRORS"\nif command -v journalctl >\/dev\/null 2>&1; then\n    journalctl -k -b 0 --no-pager 2>\/dev\/null | grep -Ei 'I\/O error|buffer I\/O|blk_update_request|critical medium error|uncorrectable|sense key|resetting link|device offline|EXT4-fs error|XFS.*error|BTRFS.*error|ZFS.*error|read-only file system|remounting filesystem read-only|bad sector|ata[0-9].*error|nvme.*error' | tail -60 || echo "No storage or filesystem errors found"\nelse\n    dmesg 2>\/dev\/null | grep -Ei 'I\/O error|buffer I\/O|blk_update_request|critical medium error|uncorrectable|sense key|resetting link|device offline|EXT4-fs error|XFS.*error|BTRFS.*error|ZFS.*error|read-only file system|remounting filesystem read-only|bad sector|ata[0-9].*error|nvme.*error' | tail -60 || echo "No storage or filesystem errors found"\nfi\nprintf "\\n%.0s" {1..3}\n\n# --- 5.9 NETWORK ERRORS ---\necho "5.9 NETWORK ERRORS"\nif command -v journalctl >\/dev\/null 2>&1; then\n    journalctl -k -b 0 --no-pager 2>\/dev\/null | grep -Ei 'link is down|link down|link becomes ready|lost carrier|no carrier|carrier lost|NETDEV WATCHDOG|transmit queue timed out|tx timeout|NIC Link is Down|renamed from|reset adapter|firmware failed|network.*error' | tail -60 || echo "No network link or adapter errors found"\nelse\n    dmesg 2>\/dev\/null | grep -Ei 'link is down|link down|link becomes ready|lost carrier|no carrier|carrier lost|NETDEV WATCHDOG|transmit queue timed out|tx timeout|NIC Link is Down|renamed from|reset adapter|firmware failed|network.*error' | tail -60 || echo "No network link or adapter errors found"\nfi\nprintf "\\n%.0s" {1..3}\n\n# --- 5.10 SERVICE FAILURES ---\necho "5.10 SERVICE FAILURES"\nif command -v journalctl >\/dev\/null 2>&1; then\n    journalctl -b 0 --no-pager 2>\/dev\/null | grep -Ei 'failed to start|failed with result|main process exited|control process exited|start request repeated too quickly|scheduled restart job|dependency failed for|entered failed state' | tail -60 || echo "No service failure events found"\nelse\n    echo "journalctl not available"\nfi\nprintf "\\n%.0s" {1..3}\n\n# --- 5.11 LOG ROTATION ---\necho "5.11 LOG ROTATION"\necho "--- Logrotate Package \/ Binary ---"\nif command -v logrotate >\/dev\/null 2>&1; then\n    logrotate --version 2>\/dev\/null | head -1\nelse\n    echo "logrotate not installed"\nfi\nprintf "\\n"\necho "--- Logrotate Configuration ---"\nls -la \/etc\/logrotate.conf \/etc\/logrotate.d\/ 2>\/dev\/null || echo "Logrotate configuration unavailable"\nprintf "\\n"\necho "--- Logrotate Status ---"\nls -la \/var\/lib\/logrotate\/status \/var\/log\/logrotate \/var\/log\/logrotate.log 2>\/dev\/null || echo "Logrotate status file or execution log unavailable"\nprintf "\\n"\necho "--- Logrotate Timer \/ Service ---"\nsystemctl status logrotate.timer logrotate.service --no-pager 2>\/dev\/null | head -40 || echo "Logrotate systemd units unavailable"\nprintf "\\n%.0s" {1..3}\n\n# --- 5.12 LARGE LOG FILES ---\necho "5.12 LARGE LOG FILES"\nfind \/var\/log -xdev -type f -printf '%s %p\\n' 2>\/dev\/null | sort -nr | head -20 | awk '{ size=$1; $1=""; printf "%10.2f MiB %s\\n", size\/1024\/1024, substr($0,2) }' || echo "Unable to inspect \/var\/log"\nprintf "\\n%.0s" {1..3}\n\n# --- 5.13 RECENTLY MODIFIED LOGS ---\necho "5.13 RECENTLY MODIFIED LOGS"\nfind \/var\/log -xdev -type f -mmin -60 -printf '%TY-%Tm-%Td %TH:%TM:%TS %p\\n' 2>\/dev\/null | sort -r | head -40 || echo "No logs modified during the last hour"\n<\/pre><\/div>\n\n
\n
\"\"<\/figure><\/div>\n\n
\n
\"\"<\/figure><\/div>\n\n
\n
\"\"<\/figure><\/div>\n\n
\n
\"\"<\/figure><\/div>\n\n
\n
\"\"<\/figure><\/div>","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"categories":[21,26],"tags":[],"_links":{"self":[{"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/pages\/1172"}],"collection":[{"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1172"}],"version-history":[{"count":2,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/pages\/1172\/revisions"}],"predecessor-version":[{"id":1179,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/pages\/1172\/revisions\/1179"}],"wp:attachment":[{"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1172"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1172"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1172"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}