The `journalctl` command

Print log entries from the systemd journal 25 examples from the lessons of the IVski Linux Playground — try them in the terminal next to them.

Options in the examples

-u, --unit=UNIT|PATTERN: Show messages for the specified systemd unit UNIT (such as a service unit), or for any of the units matched by PATTERN.
-n, --lines=: Show the most recent journal events and limit the number of events shown.
-p, --priority=: Filter output by message priorities or priority ranges.
-f, --follow: Show only the most recent journal entries, and continuously print new entries as they are appended to the journal.
-b [[ID][±offset]|all], --boot[=[ID][±offset]|all]: Show messages from a specific boot. This will add a match for "_BOOT_ID=".
--no-pager: Do not pipe output into a pager.
-r, --reverse: Reverse output so that the newest entries are displayed first.

journalctl

journalctl -r

Reverse order (newest first)

journalctl -f

journalctl -u nginx

journalctl -u nginx -f

Follow live

journalctl -u nginx --since today

journalctl --since "2024-01-15"

journalctl --since "1 hour ago"

journalctl --since "09:00" --until "10:00"

journalctl -p err

journalctl -p err -u nginx

journalctl -b

Current boot

journalctl -b -1

Previous boot

journalctl -n 50

Last 50 lines

journalctl -u nginx -n 20 --no-pager

journalctl -u myapp -f

Watch its logs

journalctl -u nginx -n 50

Recent log lines for the service

journalctl -u nginx -p err

Just the errors

journalctl -u sshd -p err

Errors from the SSH service

journalctl -u sshd | grep -i fail

Filter for failure mentions

journalctl -u sshd -p err | wc -l

journalctl -u cron -n 20

What did cron do last night?

journalctl -u nginx -n 20

The error from the failed start

journalctl -u worker -n 20

What does the worker say before it dies?

journalctl -u sshd | grep maria

What does the server say?