journalctl Command

Purpose

The journald daemon collects logs.

journalctl is used to view them.

Usage

journalctl

Displays every journal entry in the system, starting with the oldest. Pages using less.

Everything since Most Recent Boot

journalctl -b

Save Past Boot Logs

sudo mkdir -p /var/log/journal

And, in /etc/systemd/journalctl.conf:

[Journal]
Storeage=persistent

List Past Boots

journalctl --list-boots

Output:

-2 cafg.... Date time stuff
-1 abx...
 0 abcbootID....

Journal From Previous Boot

journalctl -b -1

or by boot ID:

journalctl -b abcBootID....

Time Frames

journalctl --since "YUYYY-MM-DD HH:MM:SS"

If date is omitted, Today will be assumed. If the time is ommited, midnight is substituted.

journalctl --since "2024-06-11" --until ""2024-06-12 17:05"

journalctl --since yesterday # yesterday, today, tomorrow, now

Filtering by Log Type

journalctl -u bluetooth.service

Filtering by PID

journalctl _PID=1234

By User or Group

id -u www-data  # Return UID

Output:

33

then:

journalctl _UID=33 --since today

Show All Values for a given Journal Field

journalctl -F _GID

By Path

List all entries for bash executable

journalctl /usr/bin/bash

Useful if executable doesn't have a unit available (-u)