> My results don't match your conclusion.

Alright. Let me entertain you.

In the data I provided, counting the lines in a big log file was 469.5 times faster than journalctl took to output all the logs.

From this information alone, it seems difficult to believe that journalctl --grep can be faster. Both had to read every single line of logs.

But it was on a rather slow machine, and a couple years ago.

Here /var/log and the current directory are on a "Samsung SSD 960 PRO 512GB" plugged via m2 nvme, formatted in ext4 and only 5% used. Though this shouldn't matter as I ran every command twice and collected the second run. To ensure fairness with everything in cache. The machine had 26GiB of buffer/cache in RAM during the test, indicating that everything is coming from the cache.

In my tests, journalctl was ~107 times slower than rg and ~21 times slower than grep: - journalctl: 10.631s - grep: 0.505s - rg: 0.099s

journactl also requires 4GiB of storage to store 605MB of logs. I suppose there is an inefficient key/value for every log line or something.

For some reason journalctl also returned only 273 out of 25402 lines. It only returns one type of message "session closed/opened" but not the rest. Even though it gave me all the logs in the first place without `--grep`?!

Let me know if I am still using it wrong.

    $ sudo hdparm -tT /dev/nvme0n1

    /dev/nvme0n1:
     Timing cached reads:   33022 MB in  1.99 seconds = 16612.96 MB/sec
     Timing buffered disk reads: 2342 MB in  3.00 seconds = 780.37 MB/sec

    $ du -hsc /var/log/journal
    4.0G /var/log/journal
    4.0G total

    $ time journalctl > logs
    real 0m31.429s
    user 0m28.739s
    sys 0m1.581s

    $ du -h logs
    605M logs

    $ time wc -l logs
    3932131 logs

    real 0m0.146s
    user 0m0.065s
    sys 0m0.073s

    $ time journalctl --grep=sshd | wc -l
    273

    real 0m10.631s
    user 0m10.460s
    sys 0m0.172s

    $ time rg sshd logs | wc -l
    25402

    real 0m0.099s
    user 0m0.042s
    sys 0m0.059s

    $ time grep sshd logs | wc -l
    25402

    real 0m0.505s
    user 0m0.425s
    sys 0m0.085s

PS: this way of using rg doesn't ignore any files, it is not used to find files recursively. But I don't have a .gitignore or similar in my /var/log anyways.