---
name: "journalctl-systemd-log-analysis"
description: "Query, filter, and troubleshoot Linux systemd journal logs rapidly during critical outages."
metadata:
  author: "systemd"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "query journalctl unit logs"
  - "filter journalctl by priority"
  - "vacuum journalctl disk space"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# journalctl systemd Log Inspection & Filtering Mastery

Analyzes system logs with journalctl: filtering by unit (-u), boot (-b), priority (-p err), since/until time windows, disk usage management (--vacuum-time, --vacuum-size), and exporting structured JSON logs.

## When to Invoke
Invoke this skill whenever you need to:
- query journalctl unit logs
- filter journalctl by priority
- vacuum journalctl disk space

## Execution SOP & Rules
1. Filter by service unit and follow: journalctl -u <service> -f.
2. Filter by priority level: journalctl -p err..emerg -S '1 hour ago'.
3. Query kernel ring buffer: journalctl -k -b to inspect hardware and OOM killer events.
4. Reclaim storage space: journalctl --vacuum-time=7d and verify with journalctl --disk-usage.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.