journalctl

We use journalctl to access journald logs. The command by itself outputs the entire log which will be huge and hard to scroll through. We can refine the results with modifiers.

View logs for a specific process with pid

journalctl _PID=1234

View logs for a specific time period

This can be really helpful since you can bracket the most recent events which will be more memorable.

journalctl -S -1h

View logs for a specfic systemd unit

journalctl -u [unit_name] -e

View boot logs

journalctl -b

Identify specific boot

journalctl --list-boots

List only kernel entries to the journal

journalctl -k

View logs in realtime

Use -f for --follow:

journalctl -f

890 B Raw Blame History