Query the systemd Journal?

journalctl is a utility for querying and displaying logs on systemd, kernel and journal on journald written by systemd-journald.service.

See our previous post on Systemd journal.

Working with journalctl command

1. All logs

When run without any parameters, the following command will display all the logs in the paginated view.

$ sudo journalctl

2. To reverse the order

$ sudo journalctl -r

This will display the logs in chronological order with the newest entries first.

3. To display recorded boots logs

$ sudo journalctl --list-boots

This will display all the boots of the system.

4. To display at a certain period

journalctl command allows the user to get the record of logs of a certain period.

$ sudo journalctl --since "yesterday"

$ sudo journalctl --since "6 hours ago"

$ sudo journalctl --since "2 minutes ago"

This will display all logs according to the time period.

5. To display the kernel logs

$ sudo journalctl -k

This will display all the kernel logs.

6. To display entries with a specified priority

$ sudo journalctl -p warning

It displays all log entries with priority as a warning.

7. Limit the output lines of log

$ sudo journalctl -p warning

This will display 7 log entries.

8. Follow the journal

Journalctl can print log messages to the console as they are added, much like the tail command.

$ sudo journalctl -f

This will display the journal log in real-time.

That's a wrap!!!
We hope you have found this post as useful and informative as we do.
Keep on learning and sharing knowledge.