List boots and read previous boot

Index past boots, then -b -1 reads the prior boot. note: needs persistent storage

journalctl --list-boots && journalctl -b -1 -p warning
tool
journalctl12 commands
tags
journalctlkerneltroubleshooting

More journalctl commands

  • Kernel ring buffer with timestamps
    journalctl -k -b -o short-precise --grep='segfault|I/O error'

    Like dmesg but with real wall-clock and boot filtering; -k means _TRANSPORT=kernel

  • Disk usage and vacuum by size/time
    journalctl --disk-usage; journalctl --vacuum-size=500M --vacuum-time=2d

    Show on-disk size, then prune to 500M and drop entries older than 2 days

  • Follow logs by syslog identifier
    journalctl -t kernel -t sudo -f --no-hostname

    Tail by SYSLOG_IDENTIFIER (not unit); -t repeats, --no-hostname trims clutter

  • Project selected fields as columns
    journalctl -u <name> --output=json --output-fields=__REALTIME_TIMESTAMP,MESSAGE,_PID | jq -r '[.__REALTIME_TIMESTAMP,._PID,.MESSAGE]|@tsv'

    Trim JSON to needed fields then tab-format; __REALTIME_TIMESTAMP is microseconds

  • Merge journals from a directory
    journalctl -D /mnt/crashed/var/log/journal -b -1 -p err

    Read journals from another root (rescue/forensics) without copying files in

all 12 journalctl commands