Merge journals from a directory

Read journals from another root (rescue/forensics) without copying files in

journalctl -D /mnt/crashed/var/log/journal -b -1 -p err
tool
journalctl12 commands
tags
journalctltroubleshootingdisk

More journalctl commands

  • Verify persistent storage is enabled
    journalctl --header | grep -iE 'file|state'; ls -d /var/log/journal 2>/dev/null || echo volatile

    If /var/log/journal is absent, logs are volatile and lost on reboot. fix: mkdir + systemd-tmpfiles

  • Filter by priority error and above
    journalctl -p err -b --no-pager

    Only err/crit/alert/emerg from current boot; -p takes a range too (e.g. -p warning..err)

  • Match by raw systemd unit field
    journalctl _SYSTEMD_UNIT=sshd.service --since today

    Trusted unit match by indexed field, unlike -u which also pulls coredumps/PAM noise

  • Combine field filters with OR
    journalctl _PID=1 + _COMM=sshd -o short-iso

    A bare + is a logical OR between match groups; same-field matches within a group are OR'd too

  • Regex grep across messages
    journalctl --grep='oom|out of memory' --case-sensitive=false -b

    PCRE2 match on MESSAGE; pair with -p err to narrow noise. note: scans, not indexed

all 12 journalctl commands