59 lines
890 B
Markdown
59 lines
890 B
Markdown
|
---
|
||
|
|
tags: [Linux, procedural, logs]
|
||
|
|
created: Thursday, April 24, 2025
|
||
|
|
---
|
||
|
|
|
||
|
|
# journalctl
|
||
|
|
|
||
|
|
We use `journalctl` to access [journald](./journald.md) logs. The command by
|
||
|
|
itself outputs the entire log which will be huge and hard to scroll through. We
|
||
|
|
can refine the results with modifiers.
|
||
|
|
|
||
|
|
### View logs for a specific process with pid
|
||
|
|
|
||
|
|
```bash
|
||
|
|
journalctl _PID=1234
|
||
|
|
```
|
||
|
|
|
||
|
|
### View logs for a specific time period
|
||
|
|
|
||
|
|
This can be really helpful since you can bracket the most recent events which
|
||
|
|
will be more memorable.
|
||
|
|
|
||
|
|
```bash
|
||
|
|
journalctl -S -1h
|
||
|
|
```
|
||
|
|
|
||
|
|
### View logs for a specfic systemd unit
|
||
|
|
|
||
|
|
```bash
|
||
|
|
journalctl -u [unit_name] -e
|
||
|
|
```
|
||
|
|
|
||
|
|
### View boot logs
|
||
|
|
|
||
|
|
```bash
|
||
|
|
journalctl -b
|
||
|
|
```
|
||
|
|
|
||
|
|
#### Identify specific boot
|
||
|
|
|
||
|
|
```bash
|
||
|
|
journalctl --list-boots
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
### List only kernel entries to the journal
|
||
|
|
|
||
|
|
```bash
|
||
|
|
journalctl -k
|
||
|
|
```
|
||
|
|
|
||
|
|
### View logs in realtime
|
||
|
|
|
||
|
|
Use `-f` for `--follow`:
|
||
|
|
|
||
|
|
```sh
|
||
|
|
journalctl -f
|
||
|
|
```
|