Regex grep across messages

PCRE2 match on MESSAGE; pair with -p err to narrow noise. note: scans, not indexed

journalctl --grep='oom|out of memory' --case-sensitive=false -b
tool
journalctl12 commands
tags
journalctldebugtroubleshooting

More journalctl commands

  • Verbose output with all fields
    journalctl -u <name> -o verbose -n 1

    Dumps every journal field incl. cursor for an entry; -o json-pretty for machine parsing

  • List boots and read previous boot
    journalctl --list-boots && journalctl -b -1 -p warning

    Index past boots, then -b -1 reads the prior boot. note: needs persistent storage

  • Kernel ring buffer with timestamps
    journalctl -k -b -o short-precise --grep='segfault|I/O error'

    Like dmesg but with real wall-clock and boot filtering; -k means _TRANSPORT=kernel

  • Disk usage and vacuum by size/time
    journalctl --disk-usage; journalctl --vacuum-size=500M --vacuum-time=2d

    Show on-disk size, then prune to 500M and drop entries older than 2 days

  • Follow logs by syslog identifier
    journalctl -t kernel -t sudo -f --no-hostname

    Tail by SYSLOG_IDENTIFIER (not unit); -t repeats, --no-hostname trims clutter

all 12 journalctl commands