journalctl Notes
Show logs since a specific time
journalctl --since yesterday
journalctl --since "1 hour ago"
journalctl --since "2020-09-03 12:34"
Show logs for a specific systemd unit
journalctl -u haproxy.service
Show logs for several units together
journalctl -u varnish.service -u hitch.service --since today
Show logs by executable
journalctl /usr/bin/bash
Display kernel messages
journalctl -k
Output journal entires as JSON
journalctl -b -u nobody -o json
or formatted JSON
journalctl -b -u nobody -o json-pretty
Supported output formats:
- cat: Only the message field
- export: Binary format for backup or transfer
- json: One-line per entry standard JSON
- json-pretty: Human readable JSON
- json-sse: Server-sent event compatible JSON
- short: Default
syslog
style output - short-iso: Default with ISO 8601 timestamps (
YYYY-MM-DDTHH:mm:SS+TZ
) - short-monotonic: Default with monotonic timestamps since boot (
[ 1.817288]
) - short-precise: Default with microsecond precision timestamps (
Aug 24 18:49:58.244998
) - verbose: Include every available field in each journal entry
Show the n
most recent entries (defaults to 10)
journalctl -n n
Follow logs
journalctl -f
Show current journal disk consumption
journalctl --disk-usage
Delete old journal entries
journalctl --vacuum-size=1G
journalctl --vacuum-time=1years
Comments
Post a Comment