List boots and read previous boot journalctl
Index past boots, then -b -1 reads the prior boot. note: needs persistent storage
journalctl --list-boots && journalctl -b -1 -p warning
more journalctl
all 12 commands →
Kernel ring buffer with timestamps
journalctl -k -b -o short-precise --grep='segfault|I/O error'
Disk usage and vacuum by size/time
journalctl --disk-usage; journalctl --vacuum-size=500M --vacuum-time=2d
Follow logs by syslog identifier
journalctl -t kernel -t sudo -f --no-hostname
Project selected fields as columns
journalctl -u <name> --output=json --output-fields=__REALTIME_TIMESTAMP,MESSAGE,_PID | jq -r '[.__REALTIME_TIMESTAMP,._PID,.MESSAGE]|@tsv'
Merge journals from a directory
journalctl -D /mnt/crashed/var/log/journal -b -1 -p err