Journalctl

journalctl command allows to query the contents of the systemd journal/logs.

Configuration

• /etc/systemd/journald.conf

Basic Commands

• journalctl or journalctl --no-pager
• journalctl -r (reverse order)
• journalctl -k: Show only kernel messages
• journalctl -f (follow)
• journalctl -u service-name.service

-u unit_name

journalctl -u service-name.service -f

journalctl -u libvirtd

journalctl -u ssh (See also sshd logs)

journalctl -u docker

journalctl -u UNIT_NAME -n 1 -o verbose

• journalctl --verify

Disk Usage/Logging:

• journalctl --disk-usage
• journalctl --vacuum-time=2d
• journalctl --vacuum-size=200M
  • --vacuum-size=BYTES Reduce disk usage below specified size
  • --vacuum-files=INT Leave only the specified number of journal files
  • --vacuum-time=TIME Remove journal files older than specified time
• journalctl --list-boots. See also: last (command)
• journalctl -xb

-x --catalog Includes explanations in log lines from message catalgog

-b show message from current boot. if [ID] is provided will show messages from that specific boot.

• journalctl --since "2 days ago"

Related terms

• docker run -d --log-driver=journald YOUR_CONTAINER
• rsyslogd

Activities

• Review journalctl logs

See also

• journald: journalctl journald.conf, journalctl --help, /dev/console
• systemd-journald: journalctl, /etc/systemd/journald.conf, journalctl logs, journalctl --list-boots, journalctl --disk-usage, journalctl -u kubelet, journalctl -u prometheus, journalctl --help
• Systemd: systemctl, systemd-journald, journalctl systemd-cat, systemd-logind, systemd-networkd:networkctl, systemd-timesyncd, systemd-resolved, systemd-udevd , Systemd-logind: loginctl, hostnamectl, udevadm, systemd-run, portablectl, systemd-nspawn, systemd resource management, Timer (systemd), systemd logs, /etc/systemd/, systemd services, systemd-mount, /run/systemd/, .service, /usr/lib/systemd/, /usr/lib/systemd/system/, /usr/lib/systemd/system/systemd-resolved.service, /lib/systemd/, machinectl, systemd-oomd, systemd-analyze
• /etc/inittab and respawn option
• launchd init and operating system service management daemon for MacOS
• Linux logging, Cisco IOS logging
• du, du -hs, Disk space usage, df, ls, tree, find, docker system df, journalctl --disk-usage, No space left on device, ENOSPC, sar -F, growpart, resize2fs, ncdu, duf, dua-cli

Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy.

Source: https://en.wikiversity.org/wiki/Linux_Administration/System_Services/System_Logging/Journalctl