Tech Chorus

journalctl Cheatsheet

written by Sudheer Satyanarayana on 2017-10-26

Between date ranges

journalctl --since "2017-10-20" --until "2017-10-21"

Between date and time ranges

journalctl --since "2017-10-20 10:00:00" --until "2017-10-21 11:00:00"

Friendlier unit values of since and until

journalctl --since "2017-10-20 10:00:00" --until "1 hour ago"
journalctl  --since "1 hour ago"
journalctl  --since "2 hour ago"  --until "1 hour ago"

View particular unit

journalctl -u alertmanager

where alertnamaner is the systemd unit name.

Kernel messages

journalctl -k

By priority

journalctl -p crit

Continuously watch like tail -f

journalctl -fu prometheus

Catalogue and jumping to end in the pager

journalctl -xe

This is particularly useful when your last command results in an error and you want to the most recent errors. The -x flag adds useful descriptive messages to errors when they are available.

Removing log entries

Retain only 1GB of data:

journalctl --vacuum-size=1G

Retain only 1 day worth of data:

journalctl --vacuum-time=1d

Retain only 2 files:

journalctl --vacuum-files=2
Tags: systemd logs journal journalctl linux