From: invalid@invalid.invalid   
      
   "Carlos E.R."  writes:   
   > Oh, I can use fine journalctl.   
   > When I report on bugzilla I use that.   
   >   
   > However, I do have problems with eliminating from the log the hugely   
   > verbose news facility, mail facility, and authpriv. With the   
   > concoction I have, some parts disappear, because they are not assigned   
   > any facility.   
   >   
   >   
   > From one of my bugzillas:   
   >   
   > journalctl --boot=-2 --facility=kern,user,daemon,auth,syslog,l   
   r,uucp,cron,authpriv,ftp,12,13,14,15,local0,local1,local2,local3   
   local4,local5,local6,local7 > journal_purged   
   >   
   >   
   > However, notice that several megabytes of messages like this:   
   >   
   >      Feb 18 12:17:58 Telcontar sddm[2599]: Initializing...   
   >   
   > are also missing. They are facility 1, should not be removed. I know they   
   are fac 1 by comparison with syslog:   
   >   
   >    <1.4> 2025-02-24T01:03:30.963177+01:00 Telcontar sddm 2599 - -  Signal   
   received: SIGTERM   
   >     *..... I print the  numbers.   
   >   
   > If you need those messages in the log, please advise how to remove   
   > mail and news messages from the journal. Grep doesn't work because   
   > news messages are multiline.   
      
   Not 100% clear what you’re asking but wouldn’t journalctl --unit= with   
   the unit(s) you care about be sufficient?   
      
   --   
   https://www.greenend.org.uk/rjk/   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)