journalctl

• journalctl(1)

To see messages from other users and the system, add the current user to the group systemd-journal.

Display Logs

From the Current Boot

journalctl -b

Show the past boots

journalctl --list-boots

Time Window

journalctl --since "2020-01-01" --until "2020-01-02 17:15:00"

or

journalctl --since yesterday --until "1 hour ago"

Kernel Messages

journalctl -k

Filter

By Priority

Priority: emerg, alert, crit, err, warning, notice, info, debug

journalctl -p err -b

By Facility

Facility: kern, mail, syslog, local0, ...

journalctl --facility=auth

Get list of facilities: journalctl --facility=help

By Unit

Get list of systemd units: systemctl list-units

journalctl -u ssh
journalctl -u ssh.service
journalctl --unit ssh

By Identifier

journalctl -t sshd
journalctl --identifier=sshd

By Field

Get a description of available fields: man systemd.journal-fields

Query which entries exist for a speficic field:

journalctl -F _UID
journalctl -F _PID

List all entries in the journal for a specific field:

journalctl _PID=9099

By Pattern

Grep a pattern in the message text.

Find case insensitive all entry with message containing error:

journal -g "error"

Disk Usage

journalctl --disk-usage

Clear the history

journalctl --vacuum-time=1week