Sorry, I don't understand that. Yes, the OP needs to understand what the service is called but they either know that because they set it up themselves (as with my alt. installer) or it is standard because they used Dave's script. They are already delving into the command line and this really is no more complex. Also, if they edit their package.json file:
"scripts": {
"restart": "sudo systemctl restart nrlive",
"logs": "sudo journalctl -u nrlive -e -f -n 50"
},
They can now simply run npm run logs (having changed the service name if required of course). But actually, you can see that the command is not really any more complex than a tail -f -n 50 /some/path/to/a/log/file > more and you get the benefit of more standard formatting, colour formatting, automatic paging and it continues to work even if you decide to turn off logging to file.
Using syslog, they have to know where the file is, the formatting is more complex, logs may be mixed together and so hard to follow.
The hardest thing about using journalctl is remembering the command name (is it ctl on the end or ctrl?). The hardest thing about using syslog is remembering where it is and then picking out what you want form all of the other irrelevant output.
I started by trying to point out an alternative, I've done that and it is up to the OP and any other readers of this thread to use whatever is most convenient for them. It makes no difference to me.
On my older pi, syslog is 14k lines long. 19k lines on my new home server. It takes several seconds for the cat to finish on either device (presumably network speed being the limitation). Most of the output is irrelevant. On some terminals, that amount of output might well overflow the terminal buffer and so lose the first lines. You can pipe the cat output to a pager of course - but that adds more complexity to the command though it may then let you at least search through the output - if you can remember vi commands! With jounalctl, unless you've set NR to produce masses of output. I can probably see when it restarted on 1 screen. That gives me the context.
The Node-RED log alone will tell you if it stopped without closing down as in the example you give. No need to wade through system logs unless you need to.
Anyway, you've now managed to draw me into a fairly pointless argument about which command is "better". Everyone is allowed to do it their own way. But please lets not try to force people down one way of thinking when there are other options. Let them make their own minds up.
