Kernel ring buffer with timestamps

Like dmesg but with real wall-clock and boot filtering; -k means _TRANSPORT=kernel

journalctl -k -b -o short-precise --grep='segfault|I/O error'

More journalctl commands

Disk usage and vacuum by size/time

journalctl --disk-usage; journalctl --vacuum-size=500M --vacuum-time=2d

Show on-disk size, then prune to 500M and drop entries older than 2 days
Follow logs by syslog identifier

journalctl -t kernel -t sudo -f --no-hostname

Tail by SYSLOG_IDENTIFIER (not unit); -t repeats, --no-hostname trims clutter
Project selected fields as columns

journalctl -u <name> --output=json --output-fields=__REALTIME_TIMESTAMP,MESSAGE,_PID | jq -r '[.__REALTIME_TIMESTAMP,._PID,.MESSAGE]|@tsv'

Trim JSON to needed fields then tab-format; __REALTIME_TIMESTAMP is microseconds
Merge journals from a directory

journalctl -D /mnt/crashed/var/log/journal -b -1 -p err

Read journals from another root (rescue/forensics) without copying files in
Verify persistent storage is enabled

journalctl --header | grep -iE 'file|state'; ls -d /var/log/journal 2>/dev/null || echo volatile

If /var/log/journal is absent, logs are volatile and lost on reboot. fix: mkdir + systemd-tmpfiles