Match by raw systemd unit field journalctl

Trusted unit match by indexed field, unlike -u which also pulls coredumps/PAM noise

journalctl _SYSTEMD_UNIT=sshd.service --since today

#journalctl #systemd #troubleshooting

more journalctl all 12 commands →

Combine field filters with OR journalctl _PID=1 + _COMM=sshd -o short-iso Regex grep across messages journalctl --grep='oom|out of memory' --case-sensitive=false -b Verbose output with all fields journalctl -u <name> -o verbose -n 1 List boots and read previous boot journalctl --list-boots && journalctl -b -1 -p warning Kernel ring buffer with timestamps journalctl -k -b -o short-precise --grep='segfault|I/O error'