Copied to clipboard

journalctl

`journalctl` command line is a system log viewer that can be used to view and analyze system log messages. It can filter and format log messages, as well as search for messages within a specific time range.

Examples

  • Show all journal entries: journalctl -a
  • Show boot log information: journalctl -b
  • Show logs in a specific directory: journalctl --catalog=<directory>
  • Show new log information: journalctl -f
  • Show complete log records: journalctl --full
  • Show the value of a specified field: journalctl --field=<field>
  • List available boot logs: journalctl --list-boots
  • List available log directories: journalctl --list-catalog
  • List available log fields: journalctl --list-fields
  • List known remote hosts: journalctl --list-hosts
  • List available log sources: journalctl --list-journal
  • List available system units: journalctl --list-units
  • Merge multiple log sources: journalctl --merge
  • Generate a new 128-bit ID for all records: journalctl --new-id128
  • Do not display the hostname: journalctl --no-hostname
  • Do not use a pager: journalctl --no-pager
  • Output a list of available fields to standard output: journalctl --output-fields
  • Output logs in JSON format: journalctl --output=json
  • Output logs in pretty JSON format: journalctl --output=json-pretty
  • Output logs in short format: journalctl --output=short
  • Output logs in verbose format: journalctl --output=verbose
  • Show logs with a specified priority: journalctl -p <priority>
  • Show shutdown log information: journalctl --poweroff
  • Do not show error and warning messages: journalctl --quiet
  • Display logs in reverse order: journalctl --reverse
  • Show only system-wide logs: journalctl --system
  • Show logs for a specified unit: journalctl --unit=<unit>
  • Show logs for a specified kernel message: journalctl -k <message>
  • Show logs starting from a specified date/time: journalctl -S <date/time>
  • Display UTC time in timestamps: journalctl -T
  • Display local time in timestamps: journalctl -t
  • Show logs for a specified user only: journalctl -u <user>
  • Display UTC time in timestamps: journalctl --utc
  • Limit the maximum size of the log file: journalctl --vacuum-size=<size>
  • Limit the maximum retention time of the log file: journalctl --vacuum-time=<time>