Regex grep across messages journalctl
PCRE2 match on MESSAGE; pair with -p err to narrow noise. note: scans, not indexed
journalctl --grep='oom|out of memory' --case-sensitive=false -b
more journalctl
all 12 commands →
Verbose output with all fields
journalctl -u <name> -o verbose -n 1
List boots and read previous boot
journalctl --list-boots && journalctl -b -1 -p warning
Kernel ring buffer with timestamps
journalctl -k -b -o short-precise --grep='segfault|I/O error'
Disk usage and vacuum by size/time
journalctl --disk-usage; journalctl --vacuum-size=500M --vacuum-time=2d
Follow logs by syslog identifier
journalctl -t kernel -t sudo -f --no-hostname