journalctl Command
Description¶
Linux Log Viewer
Purpose¶
The journald daemon collects logs.
journalctl is used to view them.
Usage¶
journalctl
Displays every journal entry in the system, starting with the oldest. Pages using less.
Everything since Most Recent Boot¶
journalctl -b
Save Past Boot Logs¶
sudo mkdir -p /var/log/journal
And, in /etc/systemd/journalctl.conf:
[Journal]
Storeage=persistent
List Past Boots¶
journalctl --list-boots
Output:
-2 cafg.... Date time stuff
-1 abx...
0 abcbootID....
Journal From Previous Boot¶
journalctl -b -1
or by boot ID:
journalctl -b abcBootID....
Time Frames¶
journalctl --since "YUYYY-MM-DD HH:MM:SS"
If date is omitted, Today will be assumed. If the time is ommited, midnight is substituted.
journalctl --since "2024-06-11" --until ""2024-06-12 17:05"
journalctl --since yesterday # yesterday, today, tomorrow, now
Filtering by Log Type¶
journalctl -u bluetooth.service
Filtering by PID¶
bash
journalctl _PID=1234
By User or Group¶
id -u www-data # Return UID
Output:
33
then:
journalctl _UID=33 --since today
```
## Show All Values for a given Journal Field
```bash
journalctl -F _GID
By Path¶
List all entries for bash executable
journalctl /usr/bin/bash
Useful if executable doesn't have a unit available (-u)