---
obj: application
arch-wiki: https://wiki.archlinux.org/title/Systemd/Journal
---

# journalctl

systemd has its own logging system called the journal; running a separate logging daemon is not required. To read the log, use `journalctl`.

## Usage
Show all messages matching `PATTERN`:
```
# journalctl --grep=PATTERN
```

Show all messages from this boot:
```
# journalctl -b
```

However, often one is interested in messages not from the current, but from the previous boot (e.g. if an unrecoverable system crash happened). This is possible through optional offset parameter of the `-b` flag: `journalctl -b -0` shows messages from the current boot, `journalctl -b -1` from the previous boot, `journalctl -b -2` from the second previous and so on – you can see the list of boots with their numbers by using `journalctl --list-boots`.

Include explanations of log messages from the message catalog where available:
```
# journalctl -x
```

Show all messages from date (and optional time):
```
# journalctl --since="2012-10-30 18:17:16"
```

Show all messages since 20 minutes ago:
```
# journalctl --since "20 min ago"
```

Follow new messages:
```
# journalctl -f
```

Show all messages by a specific executable:
```
# journalctl /usr/lib/systemd/systemd
```

Show all messages by a specific identifier:
```
# journalctl -t sudo
```

Show all messages by a specific process:
```
# journalctl _PID=1
```

Show all messages by a specific unit:
```
# journalctl -u man-db.service
```

Show all messages from user services by a specific unit:
```
$ journalctl --user -u dbus
```

Show kernel ring buffer:
```
# journalctl -k
```

Show only error, critical and alert priority messages:
```
# journalctl -p err..alert
```

You can use numeric log level too, like `journalctl -p 3..1`. If single number/log level is used, `journalctl -p 3`, then all higher priority log levels are also included (i.e. 0 to 3 in this case).
