journalctl

Filter by priority error and above Only err/crit/alert/emerg from current boot; -p takes a range too (e.g. -p warning..err) journalctl -p err -b --no-pager #journalctl#debug#troubleshooting Match by raw systemd unit field Trusted unit match by indexed field, unlike -u which also pulls coredumps/PAM noise journalctl _SYSTEMD_UNIT=sshd.service --since today #journalctl#systemd#troubleshooting Combine field filters with OR A bare + is a logical OR between match groups; same-field matches within a group are OR'd too journalctl _PID=1 + _COMM=sshd -o short-iso #journalctl#debug#troubleshooting Regex grep across messages PCRE2 match on MESSAGE; pair with -p err to narrow noise. note: scans, not indexed journalctl --grep='oom|out of memory' --case-sensitive=false -b #journalctl#debug#troubleshooting Verbose output with all fields Dumps every journal field incl. cursor for an entry; -o json-pretty for machine parsing journalctl -u <name> -o verbose -n 1 #journalctl#debug#observability List boots and read previous boot Index past boots, then -b -1 reads the prior boot. note: needs persistent storage journalctl --list-boots && journalctl -b -1 -p warning #journalctl#kernel#troubleshooting Kernel ring buffer with timestamps Like dmesg but with real wall-clock and boot filtering; -k means _TRANSPORT=kernel journalctl -k -b -o short-precise --grep='segfault|I/O error' #journalctl#kernel#disk Disk usage and vacuum by size/time Show on-disk size, then prune to 500M and drop entries older than 2 days journalctl --disk-usage; journalctl --vacuum-size=500M --vacuum-time=2d #journalctl#disk#performance Follow logs by syslog identifier Tail by SYSLOG_IDENTIFIER (not unit); -t repeats, --no-hostname trims clutter journalctl -t kernel -t sudo -f --no-hostname #journalctl#monitoring#observability Project selected fields as columns Trim JSON to needed fields then tab-format; __REALTIME_TIMESTAMP is microseconds journalctl -u <name> --output=json --output-fields=__REALTIME_TIMESTAMP,MESSAGE,_PID | jq -r '[.__REALTIME_TIMESTAMP,._PID,.MESSAGE]|@tsv' #journalctl#observability#debug Merge journals from a directory Read journals from another root (rescue/forensics) without copying files in journalctl -D /mnt/crashed/var/log/journal -b -1 -p err #journalctl#troubleshooting#disk Verify persistent storage is enabled If /var/log/journal is absent, logs are volatile and lost on reboot. fix: mkdir + systemd-tmpfiles journalctl --header | grep -iE 'file|state'; ls -d /var/log/journal 2>/dev/null || echo volatile #journalctl#disk#troubleshooting