Ghost Logs - The Journalctl

Systemd is with us. Some operators embrace it.
Others curse its name.
Still, the system must run. Operate. Log.

Logs are not just noise.
They are footsteps.
If you want to trace them - you use journalctl.
If you can't use it, you're blind in a fog of noise.

Logs can't help if they disappear at a reboot.
Still, some systems erase them. Quietly. Without a trace.
Ghosts don't destroy logs.

Make sure the data persists.
It must not fill up the disk.
Protect from DoS.

In the /etc/systemd/journald.conf add the following lines:

[ Journal]
 Storage=persistent
 SystemMaxUse=500M
 RateLimitIntervalSec=30s
 RateLimitBurst=1000

Clean. Tactical.

The journal keeps the data.
But only Operators can see it.

Logs since the current boot:

sudo journalctl -b

Logs since the previous boot:

sudo journalctl -b -1    #  One boot ago
sudo journalctl -b -2    #  Two boots ago

Sometimes Ghost Ops require continuous observation of the logs.
The follow mode whispers:

sudo journalctl -f

Ghosts look for precision.
Precision comes from narrowing down the findings.

They narrow by service. By unit.

sudo journalctl -u sshd.service

They filter by time:

sudo journalctl --since  "10 minutes ago"
sudo journalctl --since  "2025-06-26 10:00:00" --until  "2025-06-26 11:00:00"

You are the Operator.
Ghost Ops searches leave no noise. Only truth.

Systemd is here. Journalctl is a blade.
Some listen to the noise and bend -
their blade is dull, useless.
Ghosts sharpen it to cut.

No noise. Only signal.

Ghosts don't bend to the system.
They shape it for their taste.

DeadSwitch | The Silent Architect
"Fear the silence. Fear the Switch."