Follow logs by syslog identifier journalctl
Tail by SYSLOG_IDENTIFIER (not unit); -t repeats, --no-hostname trims clutter
journalctl -t kernel -t sudo -f --no-hostname
more journalctl
all 12 commands →
Project selected fields as columns
journalctl -u <name> --output=json --output-fields=__REALTIME_TIMESTAMP,MESSAGE,_PID | jq -r '[.__REALTIME_TIMESTAMP,._PID,.MESSAGE]|@tsv'
Merge journals from a directory
journalctl -D /mnt/crashed/var/log/journal -b -1 -p err
Verify persistent storage is enabled
journalctl --header | grep -iE 'file|state'; ls -d /var/log/journal 2>/dev/null || echo volatile
Filter by priority error and above
journalctl -p err -b --no-pager
Match by raw systemd unit field
journalctl _SYSTEMD_UNIT=sshd.service --since today