journalctl /bin/su
journalctl _EXE=/bin/su
* Automatic log cleanup to a desired storage size.
* Automatic compression, transparent decompression.
* Filtering by date, or boot number.
* Log shipping, ability to see interleaved logs from multiple machines.
* Microsecond precision for timestamps, multiple timestamp types and output formats.
* Output in JSON or multiple other formats, for trivial parsing.
* Cursors, for easily continuing parsing where you left off.
* Applications can log custom fields. No need to extract data from strings then.
* Captures logs that happen inside initramfs before / is mounted.
* Docker containers can log to the host's journald
It's pretty darn nice, really.