Match by raw systemd unit field

Trusted unit match by indexed field, unlike -u which also pulls coredumps/PAM noise

journalctl _SYSTEMD_UNIT=sshd.service --since today
tool
journalctl12 commands
tags
journalctlsystemdtroubleshooting

More journalctl commands

  • Combine field filters with OR
    journalctl _PID=1 + _COMM=sshd -o short-iso

    A bare + is a logical OR between match groups; same-field matches within a group are OR'd too

  • Regex grep across messages
    journalctl --grep='oom|out of memory' --case-sensitive=false -b

    PCRE2 match on MESSAGE; pair with -p err to narrow noise. note: scans, not indexed

  • Verbose output with all fields
    journalctl -u <name> -o verbose -n 1

    Dumps every journal field incl. cursor for an entry; -o json-pretty for machine parsing

  • List boots and read previous boot
    journalctl --list-boots && journalctl -b -1 -p warning

    Index past boots, then -b -1 reads the prior boot. note: needs persistent storage

  • Kernel ring buffer with timestamps
    journalctl -k -b -o short-precise --grep='segfault|I/O error'

    Like dmesg but with real wall-clock and boot filtering; -k means _TRANSPORT=kernel

all 12 journalctl commands