journalctl
Query and display logs from the systemd journal (https://www.freedesktop.org/software/systemd/man/latest/journalctl.html)
--- Following & Output ---
To follow logs in real time (like tail -f):
To show output in JSON format
journalctl -o json-pretty
To show logs without a pager
--- Filtering by Unit ---
To filter by a specific systemd unit:
To follow logs for a specific unit
To filter by multiple units
journalctl -u <unit1> -u <unit2>
To show list of all units logged in the journal
journalctl -F _SYSTEMD_UNIT
--- Filtering by Priority (0=emerg .. 7=debug) ---
To show logs at a specific priority and above:
To show all errors and above since last boot
To show only warning messages
journalctl -p warning..warning
--- Filtering by Time ---
To filter by time range:
journalctl --since="<YYYY-MM-DD HH:MM:SS>" --until="<YYYY-MM-DD HH:MM:SS>"
To show logs since yesterday
journalctl --since=yesterday
To show logs from the last hour
journalctl --since="1 hour ago"
--- Filtering by Boot ---
To list all available boots:
To show logs from the current boot
To show logs from the previous boot
To show logs from a specific boot by ID
--- Filtering by Process / User ---
To filter by executable path:
journalctl /usr/bin/<executable>
To filter by command name
To filter by syslog identifier
journalctl -t <identifier>
--- Kernel Logs ---
To show only kernel messages (like dmesg):
To show kernel messages from the previous boot
--- Disk Usage & Maintenance ---
To show journal disk usage:
To vacuum logs older than a given time
journalctl --vacuum-time=2weeks
To vacuum logs to keep only a maximum size
journalctl --vacuum-size=500M
To vacuum logs to keep only N files
journalctl --vacuum-files=5