---
tags: [Linux, procedural, logs]
created: Thursday, April 24, 2025
---

# journalctl

We use `journalctl` to access [journald](./journald.md) logs. The command by
itself outputs the entire log which will be huge and hard to scroll through. We
can refine the results with modifiers.

### View logs for a specific process with pid

```bash
journalctl _PID=1234
```

### View logs for a specific time period

This can be really helpful since you can bracket the most recent events which
will be more memorable.

```bash
journalctl -S -1h
```

### View logs for a specfic systemd unit

```bash
journalctl -u [unit_name] -e
```

### View boot logs

```bash
journalctl -b
```

#### Identify specific boot

```bash
journalctl --list-boots

```

### List only kernel entries to the journal

```bash
journalctl -k
```

### View logs in realtime

Use `-f` for `--follow`:

```sh
journalctl -f
```