According to the systemd docs, journalctl is recommended for browsing logs, rather than the /var/log/* file tree.While man 1 journalctl describes how to use it, I still don't know what arguments it needs to give me the list of stuff I want. For example, I want to see a list of user logins. I'm aware sshd handles ssh logins, but what about local logins and general user authentication?Here's what I've tried:#shows all logs. hugejournalctl#limit history and search for loginjournalctl --since yesterday | grep login#a week ago rather than just a dayjournalctl --since `date +%Y-%m-%d --date last week` | grep login... systemd-logind[678]: New session 81 of user jozxyqk.This seems to give some indications but definitely not the most robust method. What's the correct way?
How can I get a list of login attempts with journalctl?
fedora;logs;journald