1.9 KiB
| obj | arch-wiki |
|---|---|
| application | https://wiki.archlinux.org/title/Systemd/Journal |
journalctl
systemd has its own logging system called the journal; running a separate logging daemon is not required. To read the log, use journalctl.
Usage
Show all messages matching PATTERN:
# journalctl --grep=PATTERN
Show all messages from this boot:
# journalctl -b
However, often one is interested in messages not from the current, but from the previous boot (e.g. if an unrecoverable system crash happened). This is possible through optional offset parameter of the -b flag: journalctl -b -0 shows messages from the current boot, journalctl -b -1 from the previous boot, journalctl -b -2 from the second previous and so on – you can see the list of boots with their numbers by using journalctl --list-boots.
Include explanations of log messages from the message catalog where available:
# journalctl -x
Show all messages from date (and optional time):
# journalctl --since="2012-10-30 18:17:16"
Show all messages since 20 minutes ago:
# journalctl --since "20 min ago"
Follow new messages:
# journalctl -f
Show all messages by a specific executable:
# journalctl /usr/lib/systemd/systemd
Show all messages by a specific identifier:
# journalctl -t sudo
Show all messages by a specific process:
# journalctl _PID=1
Show all messages by a specific unit:
# journalctl -u man-db.service
Show all messages from user services by a specific unit:
$ journalctl --user -u dbus
Show kernel ring buffer:
# journalctl -k
Show only error, critical and alert priority messages:
# journalctl -p err..alert
You can use numeric log level too, like journalctl -p 3..1. If single number/log level is used, journalctl -p 3, then all higher priority log levels are also included (i.e. 0 to 3 in this case).