Select from the system log kernel events ( kernel ) associated with mounting file systems.

journalctl | grep -P journalctl | grep -P , then I do not understand what you need?
And the kernel event log kernel ?
In the beginning correctly described?

    2 answers 2

    For example:

     journalctl | grep kernel | grep mount

    The output will be something like this:

     kernel: EXT4-fs (dm-0): mounted filesystem with ordered data mode. Opts: (null) kernel: EXT4-fs (dm-0): re-mounted. Opts: errors=remount-ro kernel: EXT4-fs (sda1): mounting ext2 file system using the ext4 subsystem kernel: EXT4-fs (sda1): mounted filesystem without journal. Opts: (null)

    Update

     journalctl | grep -P '(?=.*kernel)(?=.*mounted)'
    • Thank you very much - Kirill Gorbunov
    • The completed practical task should be a single-line expression of the following form: journalctl | grep -P '<regular expression>' - Kirill Gorbunov
    • And I also have ubuntu on a virtual machine. There is no journalctl command there, as I understand it, you need to go to / var / log, this journal is there - Kirill Gorbunov
    • And what is the ubunt version? I just did this example on ubunt. And yes, you can just get / var / log / syslog (/ var / log / messages - in redhat Linux) - de_frag
    • @ KirillGorbunov added to the update with -P - de_frag

    Journalctl already has a bunch of filters

     journalctl -t kernel journalctl -k

    all events on the core

    then you can filter through grep, awk or less