Linux Command - journalctl
The linux command journalctl is a systemd tool used to display logs from the systemd journal.
- NOTE - You may need root access to access a logged info.
Here we are covering some of the more common / useful variations of this command.
journalctl # all logs from all units in a pager
journalctl -xe # -x lookup info, -e jump to end
journalctl -r # reverse
journalctl -k # only kernel related messages
journalctl -u apache2 # view logs for specific service
journalctl -u mysql # view logs for specific service
journalctl | grep -i nvidia # search for keyword
journalctl -f # tail logs, monitor in real time as they are written
journalctl --disk-usage # disk usage for logs
Selecting a time range:
journalctl --since yesterday # since a certain time
journalctl --since "2023-12-25 09:00:00" --until "2024-03-15 15:00:00" # between two dates
More useful commands:
journalctl --utc # UTC instead of local timezone
journalctl -p 3 # filter by priority 0: emergency, 7: debug
journalctl -p warning # filter by priority level
journalctl -n 10 # only 10 lines
journalctl --no-page # don't page
journalctl -o verbose # verbose output
journalctl -o json # json output
journalctl -o json-pretty
journalctl --list-boots # view a list of system boots
journalctl -b -1 # view logs from previous boot
Log levels
| 0 | emerg (Emergency): System is unusable. |
| 1 | alert (Alert): Action must be taken immediately. |
| 2 | crit (Critical): Critical conditions. |
| 3 | err (Error): Error conditions. |
| 4 | warning (Warning): Warning conditions. |
| 5 | notice (Notice): Normal but significant conditions. |
| 6 | info (Informational): Informational messages. |
| 7 | debug (Debug): Debug-level messages. |