awk — Syslog

Errors in last hour — extract timestamp and message

journalctl --since "1 hour ago" -p err --no-pager | awk '{print $1, $2, $3, $5, $6}'

Count errors by systemd unit

journalctl --since today -p err --no-pager | awk '{unit[$5]++} END{for(u in unit) print unit[u], u}' | sort -rn | head -10

Services that failed this boot

journalctl -b --no-pager | awk '/Failed to start/ {$1=$2=$3=$4=""; print}' | sort -u

Messages per hour — traffic heatmap

journalctl --since today --no-pager | awk '{split($3,t,":"); hour[t[1]]++} END{for(h in hour) printf "%s:00  %d\n",h,hour[h]}' | sort

dmesg errors and warnings

dmesg -l err,warn | awk -F']' '{print $2}' | head -20

USB events from dmesg

dmesg | awk '/usb/{print}' | tail -10

Disk I/O errors from dmesg

dmesg | awk '/error|fail|I\/O/ && /sd[a-z]/{print}'