58 lines
890 B
Markdown
58 lines
890 B
Markdown
---
|
|
tags: [Linux, procedural, logs]
|
|
created: Thursday, April 24, 2025
|
|
---
|
|
|
|
# journalctl
|
|
|
|
We use `journalctl` to access [journald](./journald.md) logs. The command by
|
|
itself outputs the entire log which will be huge and hard to scroll through. We
|
|
can refine the results with modifiers.
|
|
|
|
### View logs for a specific process with pid
|
|
|
|
```bash
|
|
journalctl _PID=1234
|
|
```
|
|
|
|
### View logs for a specific time period
|
|
|
|
This can be really helpful since you can bracket the most recent events which
|
|
will be more memorable.
|
|
|
|
```bash
|
|
journalctl -S -1h
|
|
```
|
|
|
|
### View logs for a specfic systemd unit
|
|
|
|
```bash
|
|
journalctl -u [unit_name] -e
|
|
```
|
|
|
|
### View boot logs
|
|
|
|
```bash
|
|
journalctl -b
|
|
```
|
|
|
|
#### Identify specific boot
|
|
|
|
```bash
|
|
journalctl --list-boots
|
|
|
|
```
|
|
|
|
### List only kernel entries to the journal
|
|
|
|
```bash
|
|
journalctl -k
|
|
```
|
|
|
|
### View logs in realtime
|
|
|
|
Use `-f` for `--follow`:
|
|
|
|
```sh
|
|
journalctl -f
|
|
```
|